fast-uri is a URI parser for Node.js. It decodes percent escapes in a hostname during parsing and then decodes the parsed hostname a second time during authority recomposition, so a single call to normalize or resolve can turn nested percent-encoded input into a different network destination such as a loopback hostname or address. For example, a doubly encoded host that spells out a loopback name decodes to that live host in one operation, which contradicts RFC 3986 section 2.4 that an implementation must not decode the same string more than once. An application that normalizes or resolves an untrusted HTTP-family URI before outbound routing, redirect validation, or a host-policy check can receive a destination different from the one the original encoded host represented, giving a server-side request forgery and host-policy bypass primitive. This is an incomplete-fix variant of CVE-2026-6322. The affected versions are 2.4.1 up to but not including 2.4.5, 3.1.2 up to but not including 3.1.6, and 4.0.0 up to but not including 4.1.3. The issue is fixed in 2.4.5, 3.1.6, and 4.1.3, which normalize percent escapes once and preserve encoded percent signs. Users should upgrade to a patched version.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - fast-uri is a URI parser for Node.js. It decodes percent escapes in a hostname during parsing and then
    decodes the parsed hostname a second time during authority recomposition, so a single call to normalize or
    resolve can turn nested percent-encoded input into a different network destination such as a loopback
    hostname or address. For example, a doubly encoded host that spells out a loopback name decodes to that
    live host in one operation, which contradicts RFC 3986 section 2.4 that an implementation must not decode
    the same string more than once. An application that normalizes or resolves an untrusted HTTP-family URI
    before outbound routing, redirect validation, or a host-policy check can receive a destination different
    from the one the original encoded host represented, giving a server-side request forgery and host-policy
    bypass primitive. This is an incomplete-fix variant of CVE-2026-6322. The affected versions are 2.4.1 up
    to but not including 2.4.5, 3.1.2 up to but not including 3.1.6, and 4.0.0 up to but not including 4.1.3.
    The issue is fixed in 2.4.5, 3.1.6, and 4.1.3, which normalize percent escapes once and preserve encoded
    percent signs. Users should upgrade to a patched version. (CVE-2026-75899)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:74503 advisory.

    Red Hat Satellite is a system management solution that allows organizations     to configure and maintain their systems without the necessity to provide     public Internet access to their servers or other client systems. It     performs provisioning and configuration management of predefined standard     operating environments.

    Security Fix(es):

    * rubygem-foreman_remote_execution: command injection in job invocations via effective_user parameter     (CVE-2026-12405)
    * foreman: unauthenticated information disclosure via provisioning token validation flaw (CVE-2026-12423)
    * foreman: command injection in foreman-rake errors:fetch_log via request_id parameter (CVE-2026-12540)
    * foreman: command injection in foreman-rake database tasks (CVE-2026-12541)
    * foreman: command injection in foreman-tail (CVE-2026-12542)
    * foreman: SSTI and insecure deserialization in foreman-rake configuration (CVE-2026-12544)
    * rubygem-hammer_cli: command injection via insecure editor invocation (CVE-2026-12545)
    * python3.12-dynaconf: Dynaconf: Arbitrary code execution via Server-Side Template Injection     (CVE-2026-33154)
    * yggdrasil-worker-forwarder: Go encoding/asn1: Denial of Service via excessive recursion in Unmarshal     (CVE-2026-33818)
    * yggdrasil-worker-forwarder: Golang MIME: Denial of Service via maliciously-crafted MIME header     (CVE-2026-42504)
    * nodejs-sanitize-html: PostCSS: Information disclosure and denial of service via crafted CSS input     (CVE-2026-45623)
    * python-sqlparse: sqlparse: Denial of Service via quadratic CPU consumption in SQL parsing     (CVE-2026-54284)
    * python3.12-sqlparse: sqlparse: Denial of Service via quadratic CPU consumption in SQL parsing     (CVE-2026-54284)
    * rubygem-katello: SQL injection in Registry Proxy via labels (CVE-2026-56097)
    * rubygem-katello: improper authorization logic allows resource enumeration (CVE-2026-56098)
    * yggdrasil-worker-forwarder: Go html/template: Cross-Site Scripting via pathological input     (CVE-2026-56858)
    * yggdrasil-worker-forwarder: golang net/url: Denial of Service from quadratic complexity in path     resolution (CVE-2026-56860)
    * yggdrasil-worker-forwarder: Golang crypto/tls: Denial of Service via indefinite KeyUpdate messages     (CVE-2026-56862)
    * nodejs-connected-react-router: Immutable.js: Denial of Service due to mishandling of large index values     in List operations (CVE-2026-59879)
    * nodejs-sass: Immutable.js: Denial of Service due to mishandling of large index values in List operations     (CVE-2026-59879)
    * python-sqlparse: sqlparse: Denial of Service via inefficient SQL parsing (CVE-2026-59893)
    * python3.12-sqlparse: sqlparse: Denial of Service via inefficient SQL parsing (CVE-2026-59893)
    * python-sqlparse: sqlparse: Denial of Service via quadratic CPU consumption in comment grouping     (CVE-2026-71491)
    * python3.12-sqlparse: sqlparse: Denial of Service via quadratic CPU consumption in comment grouping     (CVE-2026-71491)
    * nodejs-css-loader: nanoid: Predictable ID generation due to integer overflow (CVE-2026-73086)
    * nodejs-sanitize-html: nanoid: Predictable ID generation due to integer overflow (CVE-2026-73086)
    * nodejs-compression-webpack-plugin: fast-uri: Server-Side Request Forgery via repeated hostname percent-     decoding (CVE-2026-75899)
    * nodejs-mini-css-extract-plugin: fast-uri: Server-Side Request Forgery via repeated hostname percent-     decoding (CVE-2026-75899)
    * nodejs-webpack: fast-uri: Server-Side Request Forgery via repeated hostname percent-decoding     (CVE-2026-75899)
    * nodejs-compression-webpack-plugin: fast-uri: Host confusion via skipped IDN canonicalization     (CVE-2026-75931)
    * nodejs-mini-css-extract-plugin: fast-uri: Host confusion via skipped IDN canonicalization     (CVE-2026-75931)
    * nodejs-webpack: fast-uri: Host confusion via skipped IDN canonicalization (CVE-2026-75931)
    * nodejs-compression-webpack-plugin: fast-uri: Server-side request forgery via malformed IPv6     normalization (CVE-2026-75975)
    * nodejs-mini-css-extract-plugin: fast-uri: Server-side request forgery via malformed IPv6 normalization     (CVE-2026-75975)
    * nodejs-webpack: fast-uri: Server-side request forgery via malformed IPv6 normalization (CVE-2026-75975)
    * python3.12-gitpython: GitPython: Arbitrary file read via TagReference.create() (CVE-2026-78679)
    * rubygem-katello: Katello Content View History API Cross-Organization Authorization Bypass     (CVE-2026-79654)
    * nodejs-compression-webpack-plugin: fast-uri: Authority Injection via Unvalidated Port Serialization     (CVE-2026-84292)
    * nodejs-mini-css-extract-plugin: fast-uri: Authority Injection via Unvalidated Port Serialization     (CVE-2026-84292)
    * nodejs-webpack: fast-uri: Authority Injection via Unvalidated Port Serialization (CVE-2026-84292)
    * nodejs-compression-webpack-plugin: fast-uri: Host confusion via unbalanced URI brackets can bypass     security policies (CVE-2026-84394)
    * nodejs-mini-css-extract-plugin: fast-uri: Host confusion via unbalanced URI brackets can bypass security     policies (CVE-2026-84394)
    * nodejs-webpack: fast-uri: Host confusion via unbalanced URI brackets can bypass security policies     (CVE-2026-84394)
    * python3.12-gitpython: GitPython: Remote Code Execution via Git directory impersonation (CVE-2026-87817)
    * foreman: Safemode Bypass leading to RCE (CVE-2026-96658)
    * foreman: Excessive Permissions for Viewer Role on Preview (CVE-2026-96659)

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Rocky Linux 10.2 host has a package installed that is affected by multiple vulnerabilities as referenced in the CIQ crlsa-2026_71543 advisory.

    * fast-uri: fast-uri: Server-Side Request Forgery via repeated hostname percent-decoding (CVE-2026-75899)

    * fast-uri: fast-uri: Server-side request forgery via malformed IPv6 normalization (CVE-2026-75975)

    * fast-uri: fast-uri: URI parsing flaw enables server-side request forgery and redirects (CVE-2026-76172)

    * fast-uri: fast-uri: Authority Injection via Unvalidated Port Serialization (CVE-2026-84292)

Tenable has extracted the preceding description block directly from the CIQ security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 10 host has a package installed that is affected by multiple vulnerabilities as referenced in the ALSA-2026:71543 advisory.

    * fast-uri: fast-uri: Server-Side Request Forgery via repeated hostname percent-decoding (CVE-2026-75899)
      * fast-uri: fast-uri: Server-side request forgery via malformed IPv6 normalization (CVE-2026-75975)
      * fast-uri: fast-uri: URI parsing flaw enables server-side request forgery and redirects     (CVE-2026-76172)
      * fast-uri: fast-uri: Authority Injection via Unvalidated Port Serialization (CVE-2026-84292)

Tenable has extracted the preceding description block directly from the AlmaLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote RockyLinux 10 host has a package installed that is affected by multiple vulnerabilities as referenced in the RLSA-2026:71543 advisory.

    * fast-uri: fast-uri: Server-Side Request Forgery via repeated hostname percent-decoding (CVE-2026-75899)

    * fast-uri: fast-uri: Server-side request forgery via malformed IPv6 normalization (CVE-2026-75975)

    * fast-uri: fast-uri: URI parsing flaw enables server-side request forgery and redirects (CVE-2026-76172)

    * fast-uri: fast-uri: Authority Injection via Unvalidated Port Serialization (CVE-2026-84292)

Tenable has extracted the preceding description block directly from the RockyLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 10 host has a package installed that is affected by multiple vulnerabilities as referenced in the ELSA-2026-71543 advisory.

    [94.4-1.0.1]
    - Switch to old frotend [Orabug: 38011073] [Orabug: 37856296] [Orabug: 37856375]
    - Replaced additional upstream url [Orabug: 37856187]
    - Replaced upstream urls in documentation with oracle links [Orabug: 37856187]

    [94.4-1]
    - New upstream release

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 10 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2026:71543 advisory.

    The image-builder-frontend generates custom images suitable for deploying systems or uploading to the     cloud. It integrates into Cockpit as a frontend for osbuild.

    Security Fix(es):

    * fast-uri: fast-uri: Server-Side Request Forgery via repeated hostname percent-decoding (CVE-2026-75899)

    * fast-uri: fast-uri: Server-side request forgery via malformed IPv6 normalization (CVE-2026-75975)

    * fast-uri: fast-uri: URI parsing flaw enables server-side request forgery and redirects (CVE-2026-76172)

    * fast-uri: fast-uri: Authority Injection via Unvalidated Port Serialization (CVE-2026-84292)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - fast-uri is a URI parser for Node.js. It decodes percent escapes in a hostname during parsing and then     decodes the parsed hostname a second time during authority recomposition, so a single call to normalize or     resolve can turn nested percent-encoded input into a different network destination such as a loopback     hostname or address. For example, a doubly encoded host that spells out a loopback name decodes to that     live host in one operation, which contradicts RFC 3986 section 2.4 that an implementation must not decode     the same string more than once. An application that normalizes or resolves an untrusted HTTP-family URI     before outbound routing, redirect validation, or a host-policy check can receive a destination different     from the one the original encoded host represented, giving a server-side request forgery and host-policy     bypass primitive. This is an incomplete-fix variant of CVE-2026-6322. The affected versions are 2.4.1 up     to but not including 2.4.5, 3.1.2 up to but not including 3.1.6, and 4.0.0 up to but not including 4.1.3.
    The issue is fixed in 2.4.5, 3.1.6, and 4.1.3, which normalize percent escapes once and preserve encoded     percent signs. Users should upgrade to a patched version. (CVE-2026-75899)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
455278	Echo: fast-uri: security update to 2.4.5	Tenable Cloud Security	Echo Local Security Checks	Local	high
455278	Echo: fast-uri: security update to 2.4.5	Tenable Self-Hosted Container Security	Echo Local Security Checks	Local	high
362390	RHEL 9 : Satellite 6.19.5 Async Update (Critical) (RHSA-2026:74503)	Nessus	Red Hat Local Security Checks	Local	high
354034	Rocky Linux 10.2 [CIQ] Security Update: cockpit-image-builder Multiple Vulnerabilities (crlsa-2026_71543)	Nessus	Rocky Linux Local Security Checks	Local	high
351000	AlmaLinux 10 : cockpit-image-builder (ALSA-2026:71543)	Nessus	Alma Linux Local Security Checks	Local	high
350313	RockyLinux 10 : cockpit-image-builder (RLSA-2026:71543)	Nessus	Rocky Linux Local Security Checks	Local	high
350189	Oracle Linux 10 : cockpit-image-builder (ELSA-2026-71543)	Nessus	Oracle Linux Local Security Checks	Local	high
349732	RHEL 10 : cockpit-image-builder (RHSA-2026:71543)	Nessus	Red Hat Local Security Checks	Local	high
339304	Linux Distros Unpatched Vulnerability : CVE-2026-75899	Nessus	Misc.	Local	high

Detections

Analytics

CVE-2026-75899

high

Tenable Plugins

high

high

high

high

high

high

high

high

high