https://vulnerability.circl.lu/sightings/feed 2026-09-28T14:52:17.370848+00:00 Vulnerability-Lookup info@circl.lu python-feedgen Contains only the most 10 recent sightings. https://vulnerability.circl.lu/sighting/df3b9443-53df-447d-ba4e-6d758c88a49b/export 2026-09-28T14:52:17.400717+00:00 Automation user https://cve.circl.lu/user/automation {"uuid": "df3b9443-53df-447d-ba4e-6d758c88a49b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-75899", "type": "seen", "source": "https://gist.github.com/alon710/9abc2886db3d6d53b0a6da8c0c0bb7fc", "content": "# CVE-2026-75899: CVE-2026-75899: Double-Decoding Host Bypass and SSRF in fast-uri\n\n> **CVSS Score:** 7.5\n> **Published:** 2026-09-02\n> **Full Report:** https://cvereports.com/reports/CVE-2026-75899\n\n## Summary\nA double-decoding vulnerability in the fast-uri package allows unauthenticated remote attackers to bypass host-policy validation and conduct Server-Side Request Forgery (SSRF) attacks by submitting nested percent-encoded URI strings.\n\n## TL;DR\nThe fast-uri package redundantly decodes host components twice across the parsing and recomposition lifecycle. Attackers can leverage nested percent-encoded host strings to bypass security boundary checks, leading to unauthenticated SSRF to internal network nodes and cloud metadata endpoints.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-174 / CWE-918\n- **Attack Vector**: Network (AV:N)\n- **CVSS v3.1 Score**: 7.5 (High)\n- **EPSS Score**: 0.00234\n- **Impact Type**: Integrity (SSRF / Host Bypass)\n- **Exploit Status**: poc\n- **CISA KEV Status**: Not Listed\n\n## Affected Systems\n\n- Node.js applications running fast-uri dependency packages < 2.4.5\n- Node.js applications running fast-uri dependency packages >= 3.1.2 and < 3.1.6\n- Node.js applications running fast-uri dependency packages >= 4.0.0 and < 4.1.3\n- **fast-uri**: >= 2.4.1 < 2.4.5 (Fixed in: `2.4.5`)\n- **fast-uri**: >= 3.1.2 < 3.1.6 (Fixed in: `3.1.6`)\n- **fast-uri**: >= 4.0.0 < 4.1.3 (Fixed in: `4.1.3`)\n\n## Mitigation\n\n- Upgrade the fast-uri package to patched versions 2.4.5, 3.1.6, or 4.1.3 depending on the respective dependency branch\n- Implement deep input validation to reject hostnames containing raw percent signs (%) prior to passing them to parsing and recomposition routines\n- Verify transitive dependencies (such as fastify and related plugins) to confirm no older versions of fast-uri are pulled into the project lockfile\n\n**Remediation Steps:**\n1. Identify the current installed version of fast-uri by inspecting package-lock.json or yarn.lock\n2. Run the upgrade command: npm install fast-uri@4.1.3 (or @3.1.6 / @2.4.5 depending on your major version pin)\n3. Re-generate package lockfiles and run npm audit to confirm the security advisory is resolved\n4. Deploy the updated application to staging environments and execute validation test scripts containing nested percent-encoded vectors to ensure functionality remains normal\n\n## References\n\n- [GitHub Security Advisory (GHSA-fph4-wmhf-6fwf)](https://github.com/fastify/fast-uri/security/advisories/GHSA-fph4-wmhf-6fwf)\n- [OpenJS Foundation Security Advisories](https://cna.openjsf.org/security-advisories.html)\n- [NVD Vulnerability Details - CVE-2026-75899](https://nvd.nist.gov/vuln/detail/CVE-2026-75899)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-75899) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-09-02T18:33:43.506559Z"} 2026-09-02T18:33:43.506559+00:00 https://vulnerability.circl.lu/sighting/c8804a4d-4ced-4619-b61e-ddb513e32859/export 2026-09-28T14:52:17.403298+00:00 Automation user https://cve.circl.lu/user/automation {"uuid": "c8804a4d-4ced-4619-b61e-ddb513e32859", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-75898", "type": "published-proof-of-concept", "source": "https://t.me/GithubRedTeam/99877", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #POC\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-75898\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a t3bik\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 0 | \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-08-26 23:55:42\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\n\u65e0\u63cf\u8ff0\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-08-28T00:01:01.872433Z"} 2026-08-28T00:01:01.872433+00:00 https://vulnerability.circl.lu/sighting/ba3d5696-5494-404a-b4a0-80a2242ab7f9/export 2026-09-28T14:52:17.403445+00:00 Automation user https://cve.circl.lu/user/automation {"uuid": "ba3d5696-5494-404a-b4a0-80a2242ab7f9", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-75898", "type": "published-proof-of-concept", "source": "Telegram/ffKlG2fYJe_qUeuQCHj3J9BzzMW_6IY6h6bicEkkzdHSiG8", "content": "", "creation_timestamp": "2026-08-28T00:00:44.249742Z"} 2026-08-28T00:00:44.249742+00:00 https://vulnerability.circl.lu/sighting/18e01a96-4710-4144-90c7-5fc8c2e056f0/export 2026-09-28T14:52:17.403548+00:00 Automation user https://cve.circl.lu/user/automation {"uuid": "18e01a96-4710-4144-90c7-5fc8c2e056f0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-75898", "type": "seen", "source": "Telegram/ffKlG2fYJe_qUeuQCHj3J9BzzMW_6IY6h6bicEkkzdHSiG8", "content": "", "creation_timestamp": "2026-08-27T12:00:05.898522Z"} 2026-08-27T12:00:05.898522+00:00 https://vulnerability.circl.lu/sighting/9713138f-5d07-49de-ad41-e77d7877458a/export 2026-09-28T14:52:17.403652+00:00 Automation user https://cve.circl.lu/user/automation {"uuid": "9713138f-5d07-49de-ad41-e77d7877458a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-75898", "type": "seen", "source": "https://t.me/GithubRedTeam/99877", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #POC\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-75898\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a t3bik\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 0 | \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-08-26 23:55:42\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\n\u65e0\u63cf\u8ff0\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-08-27T04:00:04.894026Z"} 2026-08-27T04:00:04.894026+00:00 https://vulnerability.circl.lu/sighting/03ef0386-f498-4f7e-9553-6e779248477f/export 2026-09-28T14:52:17.403753+00:00 Automation user https://cve.circl.lu/user/automation {"uuid": "03ef0386-f498-4f7e-9553-6e779248477f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-75896", "type": "seen", "source": "https://bsky.app/profile/stemshop.bsky.social/post/3mtywfhaslu2c", "content": "\ud83d\udea8 CVE-2026-75896 \u2014 CVSS 9.1 CRITICAL\n\nUse of Hard-coded Credentials vulnerability in T\u00dcB\u0130TAK B\u0130LGEM Software Technologies Research Institute Lide...\n\n\ud83d\udd0e https://stemshop.top/cve/CVE-2026-75896\n\n#CVE #CyberSecurity #InfoSec", "creation_timestamp": "2026-08-26T18:07:16.514759Z"} 2026-08-26T18:07:16.514759+00:00 https://vulnerability.circl.lu/sighting/a46cd55a-3562-4694-8cf1-28283ec2f0c3/export 2026-09-28T14:52:17.403853+00:00 Automation user https://cve.circl.lu/user/automation {"uuid": "a46cd55a-3562-4694-8cf1-28283ec2f0c3", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-75896", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mtypdmphpk2t", "content": "\ud83d\udd34 CVE-2026-75896 - Critical (9.1)\n\nUse of Hard-coded Credentials vulnerability in T\u00dcB\u0130TAK B\u0130LGEM Software Technologies Research I...\n\nhttps://www.thehackerwire.com/vulnerability/CVE-2026-75896/\n\n#infosec #cybersecurity #CVE #vulnerability #security #patchstack", "creation_timestamp": "2026-08-26T16:00:59.072408Z"} 2026-08-26T16:00:59.072408+00:00 https://vulnerability.circl.lu/sighting/7f77e9d2-dc94-4c6a-aba3-1ef0a4939783/export 2026-09-28T14:52:17.403953+00:00 Automation user https://cve.circl.lu/user/automation {"uuid": "7f77e9d2-dc94-4c6a-aba3-1ef0a4939783", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-75899", "type": "seen", "source": "https://bsky.app/profile/postac001.bsky.social/post/3mttf54lll72j", "content": "Node.js\u306efast-uri\u3067\u3001URI\u306e\u30db\u30b9\u30c8\u540d\u304c\u4e8c\u91cd\u30c7\u30b3\u30fc\u30c9\u3055\u308c\u3001\u4fe1\u983c\u3067\u304d\u306a\u3044URI\u3092\u51e6\u7406\u3059\u308b\u969b\u306b\u672c\u6765\u3068\u7570\u306a\u308b\u5b9b\u5148\u306b\u30eb\u30fc\u30c6\u30a3\u30f3\u30b0\u3055\u308c\u308b\u53ef\u80fd\u6027\u304c\u3042\u308b\u3002SSRF\u3084\u30db\u30b9\u30c8\u30dd\u30ea\u30b7\u30fc\u30d0\u30a4\u30d1\u30b9\u306b\u7e4b\u304c\u308b\u6050\u308c\u2026\nCVE-2026-75899 CVSS 7.5 | HIGH", "creation_timestamp": "2026-08-24T13:15:03.967282Z"} 2026-08-24T13:15:03.967282+00:00 https://vulnerability.circl.lu/sighting/f9c8b6fd-239f-4af8-99ad-5e58543330ce/export 2026-09-28T14:52:17.404051+00:00 Automation user https://cve.circl.lu/user/automation {"uuid": "f9c8b6fd-239f-4af8-99ad-5e58543330ce", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-75899", "type": "seen", "source": "https://bsky.app/profile/suriq.io/post/3mtt6ezu55n25", "content": "fast-uri, the URL parser inside Fastify and many Node apps, can resolve a safe-looking address to localhost (CVE-2026-75899).\n\nIt slips past URL allowlist checks, and you may ship it as a hidden dependency.\n\nFix: update to 2.4.5, 3.1.6, or 4.1.3.", "creation_timestamp": "2026-08-24T11:14:13.850815Z"} 2026-08-24T11:14:13.850815+00:00 https://vulnerability.circl.lu/sighting/ff4bcfa0-9621-4ce8-99bc-dd4550051b14/export 2026-09-28T14:52:17.404146+00:00 Automation user https://cve.circl.lu/user/automation {"uuid": "ff4bcfa0-9621-4ce8-99bc-dd4550051b14", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-75899", "type": "seen", "source": "https://bsky.app/profile/ulisesgascon.com/post/3mtszcefdrc2b", "content": "\ud83d\udea8 High-severity security fix in fast-uri 2.4.5, 3.1.6, and 4.1.3 just released!\n\nPatches CVE-2026-75899. Server-side request forgery via repeated hostname percent-decoding.\n\ngithub.com/fastify/fast...", "creation_timestamp": "2026-08-24T09:43:16.616361Z"} 2026-08-24T09:43:16.616361+00:00