fast-uri is a URI parser for Node.js. It canonicalizes a host to its ASCII form only when the input carries an explicit scheme, so a scheme-relative reference such as a host preceded by two slashes is returned with its host verbatim and no error set. As a result fast-uri's own entry points disagree with each other: parse, resolve, normalize, and equal can yield different hosts for the same input depending only on whether a scheme is written out, and equal can return opposite verdicts for the same pair of hosts. An application that extracts a host with fast-uri to check it against a policy list and then resolves the same reference can make its decision on one host while the destination is another, enabling host confusion and policy bypass. The affected versions are 2.4.2 up to but not including 2.4.5, 3.1.3 up to but not including 3.1.6, and 4.0.1 up to but not including 4.1.3. The issue is fixed in 2.4.5, 3.1.6, and 4.1.3, which canonicalize the host consistently across the resolve path. Users should upgrade to a patched version.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - fast-uri is a URI parser for Node.js. It canonicalizes a host to its ASCII form only when the input
    carries an explicit scheme, so a scheme-relative reference such as a host preceded by two slashes is
    returned with its host verbatim and no error set. As a result fast-uri's own entry points disagree with
    each other: parse, resolve, normalize, and equal can yield different hosts for the same input depending
    only on whether a scheme is written out, and equal can return opposite verdicts for the same pair of
    hosts. An application that extracts a host with fast-uri to check it against a policy list and then
    resolves the same reference can make its decision on one host while the destination is another, enabling
    host confusion and policy bypass. The affected versions are 2.4.2 up to but not including 2.4.5, 3.1.3 up
    to but not including 3.1.6, and 4.0.1 up to but not including 4.1.3. The issue is fixed in 2.4.5, 3.1.6,
    and 4.1.3, which canonicalize the host consistently across the resolve path. Users should upgrade to a
    patched version. (CVE-2026-75931)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:74503 advisory.

    Red Hat Satellite is a system management solution that allows organizations     to configure and maintain their systems without the necessity to provide     public Internet access to their servers or other client systems. It     performs provisioning and configuration management of predefined standard     operating environments.

    Security Fix(es):

    * rubygem-foreman_remote_execution: command injection in job invocations via effective_user parameter     (CVE-2026-12405)
    * foreman: unauthenticated information disclosure via provisioning token validation flaw (CVE-2026-12423)
    * foreman: command injection in foreman-rake errors:fetch_log via request_id parameter (CVE-2026-12540)
    * foreman: command injection in foreman-rake database tasks (CVE-2026-12541)
    * foreman: command injection in foreman-tail (CVE-2026-12542)
    * foreman: SSTI and insecure deserialization in foreman-rake configuration (CVE-2026-12544)
    * rubygem-hammer_cli: command injection via insecure editor invocation (CVE-2026-12545)
    * python3.12-dynaconf: Dynaconf: Arbitrary code execution via Server-Side Template Injection     (CVE-2026-33154)
    * yggdrasil-worker-forwarder: Go encoding/asn1: Denial of Service via excessive recursion in Unmarshal     (CVE-2026-33818)
    * yggdrasil-worker-forwarder: Golang MIME: Denial of Service via maliciously-crafted MIME header     (CVE-2026-42504)
    * nodejs-sanitize-html: PostCSS: Information disclosure and denial of service via crafted CSS input     (CVE-2026-45623)
    * python-sqlparse: sqlparse: Denial of Service via quadratic CPU consumption in SQL parsing     (CVE-2026-54284)
    * python3.12-sqlparse: sqlparse: Denial of Service via quadratic CPU consumption in SQL parsing     (CVE-2026-54284)
    * rubygem-katello: SQL injection in Registry Proxy via labels (CVE-2026-56097)
    * rubygem-katello: improper authorization logic allows resource enumeration (CVE-2026-56098)
    * yggdrasil-worker-forwarder: Go html/template: Cross-Site Scripting via pathological input     (CVE-2026-56858)
    * yggdrasil-worker-forwarder: golang net/url: Denial of Service from quadratic complexity in path     resolution (CVE-2026-56860)
    * yggdrasil-worker-forwarder: Golang crypto/tls: Denial of Service via indefinite KeyUpdate messages     (CVE-2026-56862)
    * nodejs-connected-react-router: Immutable.js: Denial of Service due to mishandling of large index values     in List operations (CVE-2026-59879)
    * nodejs-sass: Immutable.js: Denial of Service due to mishandling of large index values in List operations     (CVE-2026-59879)
    * python-sqlparse: sqlparse: Denial of Service via inefficient SQL parsing (CVE-2026-59893)
    * python3.12-sqlparse: sqlparse: Denial of Service via inefficient SQL parsing (CVE-2026-59893)
    * python-sqlparse: sqlparse: Denial of Service via quadratic CPU consumption in comment grouping     (CVE-2026-71491)
    * python3.12-sqlparse: sqlparse: Denial of Service via quadratic CPU consumption in comment grouping     (CVE-2026-71491)
    * nodejs-css-loader: nanoid: Predictable ID generation due to integer overflow (CVE-2026-73086)
    * nodejs-sanitize-html: nanoid: Predictable ID generation due to integer overflow (CVE-2026-73086)
    * nodejs-compression-webpack-plugin: fast-uri: Server-Side Request Forgery via repeated hostname percent-     decoding (CVE-2026-75899)
    * nodejs-mini-css-extract-plugin: fast-uri: Server-Side Request Forgery via repeated hostname percent-     decoding (CVE-2026-75899)
    * nodejs-webpack: fast-uri: Server-Side Request Forgery via repeated hostname percent-decoding     (CVE-2026-75899)
    * nodejs-compression-webpack-plugin: fast-uri: Host confusion via skipped IDN canonicalization     (CVE-2026-75931)
    * nodejs-mini-css-extract-plugin: fast-uri: Host confusion via skipped IDN canonicalization     (CVE-2026-75931)
    * nodejs-webpack: fast-uri: Host confusion via skipped IDN canonicalization (CVE-2026-75931)
    * nodejs-compression-webpack-plugin: fast-uri: Server-side request forgery via malformed IPv6     normalization (CVE-2026-75975)
    * nodejs-mini-css-extract-plugin: fast-uri: Server-side request forgery via malformed IPv6 normalization     (CVE-2026-75975)
    * nodejs-webpack: fast-uri: Server-side request forgery via malformed IPv6 normalization (CVE-2026-75975)
    * python3.12-gitpython: GitPython: Arbitrary file read via TagReference.create() (CVE-2026-78679)
    * rubygem-katello: Katello Content View History API Cross-Organization Authorization Bypass     (CVE-2026-79654)
    * nodejs-compression-webpack-plugin: fast-uri: Authority Injection via Unvalidated Port Serialization     (CVE-2026-84292)
    * nodejs-mini-css-extract-plugin: fast-uri: Authority Injection via Unvalidated Port Serialization     (CVE-2026-84292)
    * nodejs-webpack: fast-uri: Authority Injection via Unvalidated Port Serialization (CVE-2026-84292)
    * nodejs-compression-webpack-plugin: fast-uri: Host confusion via unbalanced URI brackets can bypass     security policies (CVE-2026-84394)
    * nodejs-mini-css-extract-plugin: fast-uri: Host confusion via unbalanced URI brackets can bypass security     policies (CVE-2026-84394)
    * nodejs-webpack: fast-uri: Host confusion via unbalanced URI brackets can bypass security policies     (CVE-2026-84394)
    * python3.12-gitpython: GitPython: Remote Code Execution via Git directory impersonation (CVE-2026-87817)
    * foreman: Safemode Bypass leading to RCE (CVE-2026-96658)
    * foreman: Excessive Permissions for Viewer Role on Preview (CVE-2026-96659)

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - fast-uri is a URI parser for Node.js. It canonicalizes a host to its ASCII form only when the input     carries an explicit scheme, so a scheme-relative reference such as a host preceded by two slashes is     returned with its host verbatim and no error set. As a result fast-uri's own entry points disagree with     each other: parse, resolve, normalize, and equal can yield different hosts for the same input depending     only on whether a scheme is written out, and equal can return opposite verdicts for the same pair of     hosts. An application that extracts a host with fast-uri to check it against a policy list and then     resolves the same reference can make its decision on one host while the destination is another, enabling     host confusion and policy bypass. The affected versions are 2.4.2 up to but not including 2.4.5, 3.1.3 up     to but not including 3.1.6, and 4.0.1 up to but not including 4.1.3. The issue is fixed in 2.4.5, 3.1.6,     and 4.1.3, which canonicalize the host consistently across the resolve path. Users should upgrade to a     patched version. (CVE-2026-75931)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
459274	Echo: fast-uri: security update to 2.4.5	Tenable Cloud Security	Echo Local Security Checks	Local	high
459274	Echo: fast-uri: security update to 2.4.5	Tenable Self-Hosted Container Security	Echo Local Security Checks	Local	high
362390	RHEL 9 : Satellite 6.19.5 Async Update (Critical) (RHSA-2026:74503)	Nessus	Red Hat Local Security Checks	Local	high
339307	Linux Distros Unpatched Vulnerability : CVE-2026-75931	Nessus	Misc.	Local	high

Detections

Analytics

CVE-2026-75931

high

Tenable Plugins

high

high

high

high