THREAT OPS › Threat News › [GHSA] GHSA-fph4-wmhf-6fwf (high) — fast-uri vulnerable to server-side request forgery via repeated hostname percent-decoding
[GHSA] GHSA-fph4-wmhf-6fwf (high) — fast-uri vulnerable to server-side request forgery via repeated hostname percent-decoding
GHSA-fph4-wmhf-6fwf Severity: high CVE: CVE-2026-75899
fast-uri vulnerable to server-side request forgery via repeated hostname percent-decoding
### Impact
`fast-uri` decodes a hostname's percent escapes twice in a single `normalize()` or `resolve()` call: once during parsing and again during authority recomposition. A nested percent-encoded host therefore survives the first decode and is turne
Indicators of compromise
- CVE-2026-75899cve
- CVE-2026-6322cve
- http://%256c%256f%2563%2561%256c%2568%256f%2573%2574/url
Original source: https://github.com/advisories/GHSA-fph4-wmhf-6fwf