{"uuid": "f9c8b6fd-239f-4af8-99ad-5e58543330ce", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-75899", "type": "seen", "source": "https://bsky.app/profile/suriq.io/post/3mtt6ezu55n25", "content": "fast-uri, the URL parser inside Fastify and many Node apps, can resolve a safe-looking address to localhost (CVE-2026-75899).\n\nIt slips past URL allowlist checks, and you may ship it as a hidden dependency.\n\nFix: update to 2.4.5, 3.1.6, or 4.1.3.", "creation_timestamp": "2026-08-24T11:14:13.850815Z"}