fast-uri is a URI parser for Node.js. During parsing it runs a legacy decoding pass over the scheme component and never re-escapes the result, and serialization writes the scheme back out verbatim, unlike the host component which is re-escaped. As a result an input whose scheme carries percent-encoded slashes parses as a scheme with no authority, so the parsed host and error are both undefined, yet resolving or normalizing that same input emits a network-path reference whose authority is attacker-chosen and re-parses to that host. An application that allowlists on the parsed host, or treats a reference with no authority as safe to resolve against its base, gets the opposite of what it checked, giving an off-site redirect, server-side request forgery, or address-policy bypass. The legacy decoder also expands non-standard escape forms, widening the issue past upstream filters, and control characters in the scheme can reach the output as raw carriage return and line feed. The affected versions are 2.3.1 up to but not including 2.4.5, 3.0.0 up to but not including 3.1.6, and 4.0.0 up to but not including 4.1.3. The issue is fixed in 2.4.5, 3.1.6, and 4.1.3, which reject a scheme that is not valid after decoding. Users should upgrade to a patched version.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - fast-uri is a URI parser for Node.js. During parsing it runs a legacy decoding pass over the scheme
    component and never re-escapes the result, and serialization writes the scheme back out verbatim, unlike
    the host component which is re-escaped. As a result an input whose scheme carries percent-encoded slashes
    parses as a scheme with no authority, so the parsed host and error are both undefined, yet resolving or
    normalizing that same input emits a network-path reference whose authority is attacker-chosen and re-
    parses to that host. An application that allowlists on the parsed host, or treats a reference with no
    authority as safe to resolve against its base, gets the opposite of what it checked, giving an off-site
    redirect, server-side request forgery, or address-policy bypass. The legacy decoder also expands non-
    standard escape forms, widening the issue past upstream filters, and control characters in the scheme can
    reach the output as raw carriage return and line feed. The affected versions are 2.3.1 up to but not
    including 2.4.5, 3.0.0 up to but not including 3.1.6, and 4.0.0 up to but not including 4.1.3. The issue
    is fixed in 2.4.5, 3.1.6, and 4.1.3, which reject a scheme that is not valid after decoding. Users should
    upgrade to a patched version. (CVE-2026-76172)

The Rocky Linux 10.2 host has a package installed that is affected by multiple vulnerabilities as referenced in the CIQ crlsa-2026_71543 advisory.

    * fast-uri: fast-uri: Server-Side Request Forgery via repeated hostname percent-decoding (CVE-2026-75899)

    * fast-uri: fast-uri: Server-side request forgery via malformed IPv6 normalization (CVE-2026-75975)

    * fast-uri: fast-uri: URI parsing flaw enables server-side request forgery and redirects (CVE-2026-76172)

    * fast-uri: fast-uri: Authority Injection via Unvalidated Port Serialization (CVE-2026-84292)

Tenable has extracted the preceding description block directly from the CIQ security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 10 host has a package installed that is affected by multiple vulnerabilities as referenced in the ALSA-2026:71543 advisory.

    * fast-uri: fast-uri: Server-Side Request Forgery via repeated hostname percent-decoding (CVE-2026-75899)
      * fast-uri: fast-uri: Server-side request forgery via malformed IPv6 normalization (CVE-2026-75975)
      * fast-uri: fast-uri: URI parsing flaw enables server-side request forgery and redirects     (CVE-2026-76172)
      * fast-uri: fast-uri: Authority Injection via Unvalidated Port Serialization (CVE-2026-84292)

Tenable has extracted the preceding description block directly from the AlmaLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote RockyLinux 10 host has a package installed that is affected by multiple vulnerabilities as referenced in the RLSA-2026:71543 advisory.

    * fast-uri: fast-uri: Server-Side Request Forgery via repeated hostname percent-decoding (CVE-2026-75899)

    * fast-uri: fast-uri: Server-side request forgery via malformed IPv6 normalization (CVE-2026-75975)

    * fast-uri: fast-uri: URI parsing flaw enables server-side request forgery and redirects (CVE-2026-76172)

    * fast-uri: fast-uri: Authority Injection via Unvalidated Port Serialization (CVE-2026-84292)

Tenable has extracted the preceding description block directly from the RockyLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 10 host has a package installed that is affected by multiple vulnerabilities as referenced in the ELSA-2026-71543 advisory.

    [94.4-1.0.1]
    - Switch to old frotend [Orabug: 38011073] [Orabug: 37856296] [Orabug: 37856375]
    - Replaced additional upstream url [Orabug: 37856187]
    - Replaced upstream urls in documentation with oracle links [Orabug: 37856187]

    [94.4-1]
    - New upstream release

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 10 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2026:71543 advisory.

    The image-builder-frontend generates custom images suitable for deploying systems or uploading to the     cloud. It integrates into Cockpit as a frontend for osbuild.

    Security Fix(es):

    * fast-uri: fast-uri: Server-Side Request Forgery via repeated hostname percent-decoding (CVE-2026-75899)

    * fast-uri: fast-uri: Server-side request forgery via malformed IPv6 normalization (CVE-2026-75975)

    * fast-uri: fast-uri: URI parsing flaw enables server-side request forgery and redirects (CVE-2026-76172)

    * fast-uri: fast-uri: Authority Injection via Unvalidated Port Serialization (CVE-2026-84292)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - fast-uri is a URI parser for Node.js. During parsing it runs a legacy decoding pass over the scheme     component and never re-escapes the result, and serialization writes the scheme back out verbatim, unlike     the host component which is re-escaped. As a result an input whose scheme carries percent-encoded slashes     parses as a scheme with no authority, so the parsed host and error are both undefined, yet resolving or     normalizing that same input emits a network-path reference whose authority is attacker-chosen and re-     parses to that host. An application that allowlists on the parsed host, or treats a reference with no     authority as safe to resolve against its base, gets the opposite of what it checked, giving an off-site     redirect, server-side request forgery, or address-policy bypass. The legacy decoder also expands non-     standard escape forms, widening the issue past upstream filters, and control characters in the scheme can     reach the output as raw carriage return and line feed. The affected versions are 2.3.1 up to but not     including 2.4.5, 3.0.0 up to but not including 3.1.6, and 4.0.0 up to but not including 4.1.3. The issue     is fixed in 2.4.5, 3.1.6, and 4.1.3, which reject a scheme that is not valid after decoding. Users should     upgrade to a patched version. (CVE-2026-76172)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
463280	Echo: fast-uri: security update to 2.4.5	Tenable Cloud Security	Echo Local Security Checks	Local	high
463280	Echo: fast-uri: security update to 2.4.5	Tenable Self-Hosted Container Security	Echo Local Security Checks	Local	high
354034	Rocky Linux 10.2 [CIQ] Security Update: cockpit-image-builder Multiple Vulnerabilities (crlsa-2026_71543)	Nessus	Rocky Linux Local Security Checks	Local	high
351000	AlmaLinux 10 : cockpit-image-builder (ALSA-2026:71543)	Nessus	Alma Linux Local Security Checks	Local	high
350313	RockyLinux 10 : cockpit-image-builder (RLSA-2026:71543)	Nessus	Rocky Linux Local Security Checks	Local	high
350189	Oracle Linux 10 : cockpit-image-builder (ELSA-2026-71543)	Nessus	Oracle Linux Local Security Checks	Local	high
349732	RHEL 10 : cockpit-image-builder (RHSA-2026:71543)	Nessus	Red Hat Local Security Checks	Local	high
339303	Linux Distros Unpatched Vulnerability : CVE-2026-76172	Nessus	Misc.	Local	high

Detections

Analytics

CVE-2026-76172

high

Tenable Plugins

high

high

high

high

high

high

high

high