THREATOPS
THREAT OPSThreat News › [GHSA] GHSA-fph4-wmhf-6fwf (high) — fast-uri vulnerable to server-side request forgery via repeated hostname percent-decoding

[GHSA] GHSA-fph4-wmhf-6fwf (high) — fast-uri vulnerable to server-side request forgery via repeated hostname percent-decoding

highgithub_advisoriesPublished 2026-09-02

GHSA-fph4-wmhf-6fwf Severity: high CVE: CVE-2026-75899

fast-uri vulnerable to server-side request forgery via repeated hostname percent-decoding

### Impact

`fast-uri` decodes a hostname's percent escapes twice in a single `normalize()` or `resolve()` call: once during parsing and again during authority recomposition. A nested percent-encoded host therefore survives the first decode and is turne

Indicators of compromise

Original source: https://github.com/advisories/GHSA-fph4-wmhf-6fwf