{"id":"GHSA-jqff-g426-hqxp","revision":null,"records":[{"revision":"9e870d5c786e48fcbcfe752295f7a571","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2026-76172","aliases":[],"title":"fast-uri vulnerable to host confusion via percent-encoded scheme normalization","description":"fast-uri is a URI parser for Node.js. During parsing it runs a legacy decoding pass over the scheme component and never re-escapes the result, and serialization writes the scheme back out verbatim, unlike the host component which is re-escaped. As a result an input whose scheme carries percent-encoded slashes parses as a scheme with no authority, so the parsed host and error are both undefined, yet resolving or normalizing that same input emits a network-path reference whose authority is attacker-chosen and re-parses to that host. An application that allowlists on the parsed host, or treats a reference with no authority as safe to resolve against its base, gets the opposite of what it checked, giving an off-site redirect, server-side request forgery, or address-policy bypass. The legacy decoder also expands non-standard escape forms, widening the issue past upstream filters, and control characters in the scheme can reach the output as raw carriage return and line feed. The affected versions are 2.3.1 up to but not including 2.4.5, 3.0.0 up to but not including 3.1.6, and 4.0.0 up to but not including 4.1.3. The issue is fixed in 2.4.5, 3.1.6, and 4.1.3, which reject a scheme that is not valid after decoding. Users should upgrade to a patched version.","state":0,"publishedAt":"2026-08-24T10:07:56.44+00:00","modifiedAt":"2026-08-24T14:29:37.95+00:00","affected":[{"ecosystem":"Vendor product","name":"fast-uri","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"fast-uri\",\n                    \"product\": \"fast-uri\",\n                    \"defaultStatus\": \"unaffected\",\n                    \"versions\": [\n                        {\n                            \"versionType\": \"semver\",\n                            \"status\": \"affected\",\n                            \"version\": \"2.3.1\",\n                            \"lessThan\": \"2.4.5\"\n                        },\n                        {\n                            \"versionType\": \"semver\",\n                            \"status\": \"unaffected\",\n                            \"version\": \"2.4.5\"\n                        },\n                        {\n                            \"versionType\": \"semver\",\n                            \"status\": \"affected\",\n                            \"version\": \"3.0.0\",\n                            \"lessThan\": \"3.1.6\"\n                        },\n                        {\n                            \"versionType\": \"semver\",\n                            \"status\": \"unaffected\",\n                            \"version\": \"3.1.6\"\n                        },\n                        {\n                            \"versionType\": \"semver\",\n                            \"status\": \"affected\",\n                            \"version\": \"4.0.0\",\n                            \"lessThan\": \"4.1.3\"\n                        },\n                        {\n                            \"versionType\": \"semver\",\n                            \"status\": \"unaffected\",\n                            \"version\": \"4.1.3\"\n                        }\n                    ],\n                    \"packageURL\": \"pkg:npm/fast-uri\"\n                }"}],"metrics":[{"system":"CVSS 3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","score":7.5,"severity":"HIGH"}],"references":["https://github.com/fastify/fast-uri/security/advisories/GHSA-jqff-g426-hqxp","https://cna.openjsf.org/security-advisories.html"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-76172","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-76172","identifiers":["CVE-2026-76172"]},"retained":false,"historicalAffected":[]},{"revision":"b5fe57e0e90f4d08a3432c5b6cf15849","observedAt":"2026-11-09T15:12:28.973+00:00","statement":{"source":"euvd","id":"EUVD-2026-64773","aliases":["CVE-2026-76172","GHSA-jqff-g426-hqxp"],"title":"fast-uri is a URI parser for Node.js. During parsing it runs a legacy decoding pass over the scheme component and never re-escapes the result, and serialization writes the scheme back out verbatim, unlike the host component which is re-esca…","description":"fast-uri is a URI parser for Node.js. During parsing it runs a legacy decoding pass over the scheme component and never re-escapes the result, and serialization writes the scheme back out verbatim, unlike the host component which is re-escaped. As a result an input whose scheme carries percent-encoded slashes parses as a scheme with no authority, so the parsed host and error are both undefined, yet resolving or normalizing that same input emits a network-path reference whose authority is attacker-chosen and re-parses to that host. An application that allowlists on the parsed host, or treats a reference with no authority as safe to resolve against its base, gets the opposite of what it checked, giving an off-site redirect, server-side request forgery, or address-policy bypass. The legacy decoder also expands non-standard escape forms, widening the issue past upstream filters, and control characters in the scheme can reach the output as raw carriage return and line feed. The affected versions are 2.3.1 up to but not including 2.4.5, 3.0.0 up to but not including 3.1.6, and 4.0.0 up to but not including 4.1.3. The issue is fixed in 2.4.5, 3.1.6, and 4.1.3, which reject a scheme that is not valid after decoding. Users should upgrade to a patched version.","state":0,"publishedAt":null,"modifiedAt":null,"affected":[],"metrics":[{"system":"EUVD CVSS 3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","score":7.5,"severity":null}],"references":["https://github.com/fastify/fast-uri/security/advisories/GHSA-jqff-g426-hqxp","https://cna.openjsf.org/security-advisories.html"],"sourceUrl":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-64773","license":"ENISA EUVD · source terms and attribution apply","enrichment":{"sourceStatus":null,"weaknesses":[],"productCriteria":[],"sourceDates":{"datePublished":"Aug 24, 2026, 10:07:56 AM","dateUpdated":"Aug 24, 2026, 2:29:37 PM"},"relatedAdvisories":[{"id":"RHSA-2026:68681","title":"Red Hat Security Advisory: Migration Toolkit for Containers (MTC) 1.8.17 update","vulnerabilityIds":["CVE-2026-14257","CVE-2026-16221","CVE-2026-27145","CVE-2026-33186","CVE-2026-33818","CVE-2026-42504","CVE-2026-56852","CVE-2026-56853","CVE-2026-56859","CVE-2026-56860","CVE-2026-56862","CVE-2026-59869","CVE-2026-59873","CVE-2026-59874","CVE-2026-67313","CVE-2026-67314","CVE-2026-67320","CVE-2026-67321","CVE-2026-69152","CVE-2026-69192","CVE-2026-73088","CVE-2026-73089","CVE-2026-73566","CVE-2026-73643","CVE-2026-73646","CVE-2026-75899","CVE-2026-75931","CVE-2026-75975","CVE-2026-76172","CVE-2026-76844","CVE-2026-82417","CVE-2026-84292","CVE-2026-84375","CVE-2026-84394"]},{"id":"RHSA-2026:92650","title":"Red Hat Security Advisory: Red Hat OpenShift Data Foundation 4.19.26 security, enhancement & bug fix update","vulnerabilityIds":["CVE-2025-66418","CVE-2025-66471","CVE-2026-14257","CVE-2026-19534","CVE-2026-21441","CVE-2026-33814","CVE-2026-42055","CVE-2026-45819","CVE-2026-59879","CVE-2026-67213","CVE-2026-67214","CVE-2026-69152","CVE-2026-69153","CVE-2026-73086","CVE-2026-73088","CVE-2026-73569","CVE-2026-73643","CVE-2026-75899","CVE-2026-75931","CVE-2026-75975","CVE-2026-76172","CVE-2026-84292","CVE-2026-84375","CVE-2026-84394","CVE-2026-84961","CVE-2026-85152"]},{"id":"RHSA-2026:82151","title":"Red Hat Security Advisory: Ansible automation portal Red Hat Enterprise Linux Images","vulnerabilityIds":["CVE-2026-13697","CVE-2026-19534","CVE-2026-47683","CVE-2026-47686","CVE-2026-47698","CVE-2026-54284","CVE-2026-55553","CVE-2026-59893","CVE-2026-71491","CVE-2026-75899","CVE-2026-75931","CVE-2026-75975","CVE-2026-76172","CVE-2026-77037","CVE-2026-82333","CVE-2026-82417","CVE-2026-84292","CVE-2026-84375","CVE-2026-84394","CVE-2026-84961","CVE-2026-88932","CVE-2026-92934","CVE-2026-92935","CVE-2026-92937","CVE-2026-92938","CVE-2026-92939","CVE-2026-92940","CVE-2026-92941","CVE-2026-92942","CVE-2026-92944","CVE-2026-92946","CVE-2026-92947","CVE-2026-92948","CVE-2026-92950","CVE-2026-92951","CVE-2026-92953","CVE-2026-92954","CVE-2026-92955","CVE-2026-92956","CVE-2026-92957","CVE-2026-92958","CVE-2026-92959","CVE-2026-92960","CVE-2026-92961","CVE-2026-93603","CVE-2026-93604","CVE-2026-93605","CVE-2026-93606"]},{"id":"RHSA-2026:72880","title":"Red Hat Security Advisory: Red Hat Advanced Cluster Management for Kubernetes v2.16.6 security update","vulnerabilityIds":["CVE-2026-48586","CVE-2026-55969","CVE-2026-66780","CVE-2026-75899","CVE-2026-75931","CVE-2026-75975","CVE-2026-76172"]},{"id":"RHSA-2026:74609","title":"Red Hat Security Advisory: Cluster Observability Operator 1.5.3","vulnerabilityIds":["CVE-2026-19534","CVE-2026-39244","CVE-2026-41178","CVE-2026-42504","CVE-2026-45623","CVE-2026-56864","CVE-2026-56865","CVE-2026-59887","CVE-2026-63199","CVE-2026-71556","CVE-2026-73086","CVE-2026-75899","CVE-2026-75931","CVE-2026-75975","CVE-2026-76172","CVE-2026-84292","CVE-2026-84394","CVE-2026-84445","CVE-2026-84961","CVE-2026-92000","CVE-2026-100690"]},{"id":"RHSA-2026:68547","title":"Red Hat Security Advisory: OpenShift Container Platform 4.21.34 security and extras update","vulnerabilityIds":["CVE-2026-16221","CVE-2026-18446","CVE-2026-33814","CVE-2026-45819","CVE-2026-75899","CVE-2026-75931","CVE-2026-75975","CVE-2026-76172","CVE-2026-84292","CVE-2026-84394"]},{"id":"RHSA-2026:86891","title":"Red Hat Security Advisory: RHOAI 3.5.2 - Red Hat OpenShift AI","vulnerabilityIds":["CVE-2024-14029","CVE-2026-13697","CVE-2026-15679","CVE-2026-15789","CVE-2026-18427","CVE-2026-19534","CVE-2026-37237","CVE-2026-49825","CVE-2026-49855","CVE-2026-54284","CVE-2026-56859","CVE-2026-59296","CVE-2026-59893","CVE-2026-62243","CVE-2026-62384","CVE-2026-63209","CVE-2026-63374","CVE-2026-66007","CVE-2026-68494","CVE-2026-68497","CVE-2026-69097","CVE-2026-69112","CVE-2026-69152","CVE-2026-69243","CVE-2026-69244","CVE-2026-71281","CVE-2026-71491","CVE-2026-73417","CVE-2026-73502","CVE-2026-73508","CVE-2026-73646","CVE-2026-75838","CVE-2026-75899","CVE-2026-75931","CVE-2026-75975","CVE-2026-76098","CVE-2026-76169","CVE-2026-76172","CVE-2026-76222","CVE-2026-76905","CVE-2026-77354","CVE-2026-77874","CVE-2026-78676","CVE-2026-78677","CVE-2026-78679","CVE-2026-78682","CVE-2026-79674","CVE-2026-79675","CVE-2026-80205","CVE-2026-81722","CVE-2026-81724","CVE-2026-81725","CVE-2026-81726","CVE-2026-81727","CVE-2026-82397","CVE-2026-82417","CVE-2026-84292","CVE-2026-84375","CVE-2026-84381","CVE-2026-84382","CVE-2026-84394","CVE-2026-84428","CVE-2026-84445","CVE-2026-84469","CVE-2026-84504","CVE-2026-84782","CVE-2026-84961","CVE-2026-85124","CVE-2026-85152","CVE-2026-85525","CVE-2026-86332","CVE-2026-87776","CVE-2026-87817","CVE-2026-87819","CVE-2026-88029","CVE-2026-88031","CVE-2026-89425","CVE-2026-91990","CVE-2026-93348","CVE-2026-93599","CVE-2026-93657","CVE-2026-93749","CVE-2026-96749","CVE-2026-96775","CVE-2026-102925","CVE-2026-102930","CVE-2026-102937","CVE-2026-102938","CVE-2026-102990","CVE-2026-104851","CVE-2026-104852","CVE-2026-104861","CVE-2026-104873"]},{"id":"RHSA-2026:67542","title":"Red Hat Security Advisory: Red Hat Advanced Cluster Management for Kubernetes v2.16.5 security update","vulnerabilityIds":["CVE-2026-41178","CVE-2026-42154","CVE-2026-48586","CVE-2026-55969","CVE-2026-56852","CVE-2026-66780","CVE-2026-71556","CVE-2026-75899","CVE-2026-75931","CVE-2026-75975","CVE-2026-76172","CVE-2026-89060"]},{"id":"RHSA-2026:68755","title":"Red Hat Security Advisory: Technical preview of the satellite/iop-vulnerability-frontend-rhel9 container image","vulnerabilityIds":["CVE-2026-12143","CVE-2026-45623","CVE-2026-45819","CVE-2026-67313","CVE-2026-67314","CVE-2026-67320","CVE-2026-67321","CVE-2026-73086","CVE-2026-73088","CVE-2026-73089","CVE-2026-73646","CVE-2026-75899","CVE-2026-75931","CVE-2026-75975","CVE-2026-76172"]},{"id":"RHSA-2026:70593","title":"Red Hat Security Advisory: Network Observability 1.12.3 for OpenShift","vulnerabilityIds":["CVE-2026-33818","CVE-2026-56852","CVE-2026-56853","CVE-2026-56859","CVE-2026-56860","CVE-2026-56862","CVE-2026-65819","CVE-2026-67213","CVE-2026-75899","CVE-2026-75931","CVE-2026-75975","CVE-2026-76172","CVE-2026-84292","CVE-2026-84375","CVE-2026-84394","CVE-2026-84445"]},{"id":"RHSA-2026:65155","title":"Red Hat Security Advisory: Ansible plug-ins for Red Hat Developer Hub Product Release Update","vulnerabilityIds":["CVE-2026-67213","CVE-2026-67214","CVE-2026-73563","CVE-2026-73566","CVE-2026-75838","CVE-2026-75899","CVE-2026-75931","CVE-2026-75975","CVE-2026-76172","CVE-2026-84292","CVE-2026-84394"]},{"id":"RHSA-2026:79088","title":"Red Hat Security Advisory: Red Hat Developer Hub 1.10.5 release.","vulnerabilityIds":["CVE-2026-13697","CVE-2026-14456","CVE-2026-18798","CVE-2026-19534","CVE-2026-47683","CVE-2026-47686","CVE-2026-47698","CVE-2026-55553","CVE-2026-63072","CVE-2026-63076","CVE-2026-67213","CVE-2026-67214","CVE-2026-67422","CVE-2026-75899","CVE-2026-75931","CVE-2026-75975","CVE-2026-76172","CVE-2026-77037","CVE-2026-77078","CVE-2026-82333","CVE-2026-82417","CVE-2026-84292","CVE-2026-84375","CVE-2026-84394","CVE-2026-84445","CVE-2026-84961","CVE-2026-87776","CVE-2026-88932","CVE-2026-89011","CVE-2026-92934","CVE-2026-92935","CVE-2026-92937","CVE-2026-92938","CVE-2026-92939","CVE-2026-92940","CVE-2026-92941","CVE-2026-92942","CVE-2026-92944","CVE-2026-92946","CVE-2026-92947","CVE-2026-92948","CVE-2026-92950","CVE-2026-92951","CVE-2026-92953","CVE-2026-92954","CVE-2026-92955","CVE-2026-92956","CVE-2026-92957","CVE-2026-92958","CVE-2026-92959","CVE-2026-92960","CVE-2026-92961","CVE-2026-93603","CVE-2026-93604","CVE-2026-93605","CVE-2026-93606"]},{"id":"RHSA-2026:60856","title":"Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update","vulnerabilityIds":["CVE-2026-75899","CVE-2026-75931","CVE-2026-75975","CVE-2026-76172"]},{"id":"RHSA-2026:60855","title":"Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update","vulnerabilityIds":["CVE-2026-6322","CVE-2026-75899","CVE-2026-75931","CVE-2026-75975","CVE-2026-76172"]},{"id":"RHSA-2026:67279","title":"Red Hat Security Advisory: Red Hat Ansible Automation Platform 2.7 Container Release Update","vulnerabilityIds":["CVE-2025-57847","CVE-2026-12564","CVE-2026-14257","CVE-2026-15307","CVE-2026-42215","CVE-2026-42284","CVE-2026-42504","CVE-2026-44244","CVE-2026-49825","CVE-2026-54284","CVE-2026-59877","CVE-2026-59893","CVE-2026-67322","CVE-2026-67323","CVE-2026-67325","CVE-2026-69152","CVE-2026-69153","CVE-2026-69243","CVE-2026-69244","CVE-2026-71491","CVE-2026-73620","CVE-2026-73622","CVE-2026-73623","CVE-2026-73624","CVE-2026-73625","CVE-2026-75899","CVE-2026-75931","CVE-2026-75975","CVE-2026-76172","CVE-2026-78679","CVE-2026-84375"]},{"id":"RHSA-2026:72849","title":"Red Hat Security Advisory: multicluster engine for Kubernetes v2.17.3 security update","vulnerabilityIds":["CVE-2026-41178","CVE-2026-56852","CVE-2026-73500","CVE-2026-75899","CVE-2026-75931","CVE-2026-75975","CVE-2026-76172","CVE-2026-84445","CVE-2026-88031"]},{"id":"RHSA-2026:68254","title":"Red Hat Security Advisory: Red Hat Edge Manager Version 1.2.1 Security Update","vulnerabilityIds":["CVE-2026-6377","CVE-2026-13149","CVE-2026-13676","CVE-2026-17106","CVE-2026-27145","CVE-2026-33818","CVE-2026-41178","CVE-2026-44740","CVE-2026-45819","CVE-2026-48050","CVE-2026-50162","CVE-2026-56853","CVE-2026-56858","CVE-2026-56859","CVE-2026-56860","CVE-2026-56862","CVE-2026-59869","CVE-2026-69152","CVE-2026-71556","CVE-2026-73089","CVE-2026-73643","CVE-2026-75899","CVE-2026-75931","CVE-2026-75975","CVE-2026-76172","CVE-2026-81521","CVE-2026-84292","CVE-2026-84375","CVE-2026-84394"]},{"id":"RHSA-2026:72848","title":"Red Hat Security Advisory: multicluster engine for Kubernetes v2.11.7 security update","vulnerabilityIds":["CVE-2026-39830","CVE-2026-39831","CVE-2026-41178","CVE-2026-46597","CVE-2026-56858","CVE-2026-56860","CVE-2026-73500","CVE-2026-75899","CVE-2026-75931","CVE-2026-75975","CVE-2026-76172","CVE-2026-84445"]},{"id":"RHSA-2026:60866","title":"Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update","vulnerabilityIds":["CVE-2026-73501","CVE-2026-75899","CVE-2026-75931","CVE-2026-75975","CVE-2026-76172","CVE-2026-82562"]},{"id":"RHSA-2026:68765","title":"Red Hat Security Advisory: Technical preview of the satellite/iop-vulnerability-frontend-rhel9 container image","vulnerabilityIds":["CVE-2026-12143","CVE-2026-45819","CVE-2026-59879","CVE-2026-67313","CVE-2026-67314","CVE-2026-67320","CVE-2026-67321","CVE-2026-73088","CVE-2026-73089","CVE-2026-73646","CVE-2026-75931","CVE-2026-75975","CVE-2026-76172"]},{"id":"RHSA-2026:68756","title":"Red Hat Security Advisory: General availability of the satellite/iop-host-inventory-frontend-rhel9 container image","vulnerabilityIds":["CVE-2026-59879","CVE-2026-73646","CVE-2026-75899","CVE-2026-75931","CVE-2026-75975","CVE-2026-76172","CVE-2026-84292","CVE-2026-84394"]},{"id":"RHSA-2026:92510","title":"Red Hat Security Advisory: RHOAI 3.4.6 - Red Hat OpenShift AI","vulnerabilityIds":["CVE-2023-54404","CVE-2026-11822","CVE-2026-11824","CVE-2026-13717","CVE-2026-16221","CVE-2026-17106","CVE-2026-18446","CVE-2026-25681","CVE-2026-26007","CVE-2026-27136","CVE-2026-33814","CVE-2026-33818","CVE-2026-39821","CVE-2026-39834","CVE-2026-41178","CVE-2026-42502","CVE-2026-45819","CVE-2026-45820","CVE-2026-56853","CVE-2026-56858","CVE-2026-56859","CVE-2026-56860","CVE-2026-56862","CVE-2026-57516","CVE-2026-59951","CVE-2026-63209","CVE-2026-63374","CVE-2026-65898","CVE-2026-67312","CVE-2026-67314","CVE-2026-67320","CVE-2026-67321","CVE-2026-69097","CVE-2026-69153","CVE-2026-73086","CVE-2026-73088","CVE-2026-73089","CVE-2026-73643","CVE-2026-75838","CVE-2026-75899","CVE-2026-75931","CVE-2026-75975","CVE-2026-76172","CVE-2026-76844","CVE-2026-77301","CVE-2026-78679","CVE-2026-82397","CVE-2026-83663","CVE-2026-84375","CVE-2026-84445","CVE-2026-85393","CVE-2026-85525","CVE-2026-87018","CVE-2026-90711","CVE-2026-91990","CVE-2026-92599","CVE-2026-93690","CVE-2026-93749","CVE-2026-94637","CVE-2026-96640","CVE-2026-96643","CVE-2026-96644","CVE-2026-96778","CVE-2026-96804","CVE-2026-97687","CVE-2026-97689","CVE-2026-102267","CVE-2026-102271","CVE-2026-102272","CVE-2026-102276","CVE-2026-102278","CVE-2026-102282","CVE-2026-104150","CVE-2026-104851","CVE-2026-105922","CVE-2026-106445","CVE-2026-106446","CVE-2026-109156","CVE-2026-109383","CVE-2026-109527","CVE-2026-109829","CVE-2026-109869","CVE-2026-109956","CVE-2026-110856","CVE-2026-110857","CVE-2026-110858","CVE-2026-110859","CVE-2026-111064","CVE-2026-111066","CVE-2026-111497","CVE-2026-112390","CVE-2026-112391","CVE-2026-112392","CVE-2026-112397","CVE-2026-112399","CVE-2026-112400","CVE-2026-112402","CVE-2026-112404","CVE-2026-112405","CVE-2026-112893","CVE-2026-112894","CVE-2026-112895","CVE-2026-112896","CVE-2026-112897","CVE-2026-112940","CVE-2026-114145"]},{"id":"RHSA-2026:61783","title":"Red Hat Security Advisory: A Subscription Management tool for finding and reporting Red Hat product usage","vulnerabilityIds":["CVE-2024-29180","CVE-2026-1965","CVE-2026-3783","CVE-2026-5704","CVE-2026-6322","CVE-2026-6653","CVE-2026-8286","CVE-2026-9547","CVE-2026-11822","CVE-2026-11824","CVE-2026-11979","CVE-2026-14164","CVE-2026-15588","CVE-2026-18477","CVE-2026-18508","CVE-2026-41991","CVE-2026-41992","CVE-2026-45409","CVE-2026-45623","CVE-2026-54284","CVE-2026-54371","CVE-2026-56434","CVE-2026-58010","CVE-2026-58011","CVE-2026-58012","CVE-2026-58013","CVE-2026-58014","CVE-2026-58015","CVE-2026-58055","CVE-2026-59868","CVE-2026-59869","CVE-2026-59893","CVE-2026-60005","CVE-2026-67213","CVE-2026-67214","CVE-2026-71491","CVE-2026-73643","CVE-2026-75899","CVE-2026-75931","CVE-2026-75975","CVE-2026-76172","CVE-2026-76844"]},{"id":"RHSA-2026:68553","title":"Red Hat Security Advisory: OpenShift Container Platform 4.22.15 security and extras update","vulnerabilityIds":["CVE-2026-16221","CVE-2026-18446","CVE-2026-33814","CVE-2026-45819","CVE-2026-75899","CVE-2026-75931","CVE-2026-75975","CVE-2026-76172","CVE-2026-84292","CVE-2026-84394"]},{"id":"RHSA-2026:68766","title":"Red Hat Security Advisory: General availability of the satellite/iop-remediations-rhel9 container image","vulnerabilityIds":["CVE-2026-12143","CVE-2026-44705","CVE-2026-59869","CVE-2026-75899","CVE-2026-75931","CVE-2026-75975","CVE-2026-76172","CVE-2026-82417","CVE-2026-84375"]},{"id":"RHSA-2026:68750","title":"Red Hat Security Advisory: General availability of the satellite/iop-host-inventory-frontend-rhel9 container image","vulnerabilityIds":["CVE-2026-73646","CVE-2026-75899","CVE-2026-75931","CVE-2026-75975","CVE-2026-76172","CVE-2026-84292","CVE-2026-84394"]},{"id":"RHSA-2026:68006","title":"Red Hat Security Advisory: Red Hat Edge Manager Version 1.2.1 Security Update","vulnerabilityIds":["CVE-2026-6377","CVE-2026-13149","CVE-2026-13676","CVE-2026-17106","CVE-2026-27145","CVE-2026-33818","CVE-2026-41178","CVE-2026-44740","CVE-2026-45819","CVE-2026-48050","CVE-2026-50162","CVE-2026-56853","CVE-2026-56858","CVE-2026-56859","CVE-2026-56860","CVE-2026-56862","CVE-2026-59869","CVE-2026-69152","CVE-2026-71556","CVE-2026-73089","CVE-2026-73643","CVE-2026-75899","CVE-2026-75931","CVE-2026-75975","CVE-2026-76172","CVE-2026-81521","CVE-2026-84292","CVE-2026-84375","CVE-2026-84394"]},{"id":"WID-SEC-W-2026-4056","title":"Atlassian Produkte (Bamboo, Bitbucket, Confluence, Crucible, Fisheye und Jira): Mehrere Schwachstellen","vulnerabilityIds":["CVE-2026-101898","CVE-2026-101901","CVE-2026-101903","CVE-2026-101905","CVE-2026-101906","CVE-2026-101907","CVE-2026-101909","CVE-2026-12185","CVE-2026-12802","CVE-2026-12860","CVE-2026-13006","CVE-2026-13676","CVE-2026-14682","CVE-2026-18036","CVE-2026-19534","CVE-2026-19693","CVE-2026-41842","CVE-2026-41845","CVE-2026-41850","CVE-2026-49434","CVE-2026-50750","CVE-2026-53404","CVE-2026-54399","CVE-2026-54428","CVE-2026-54512","CVE-2026-54513","CVE-2026-55153","CVE-2026-55831","CVE-2026-55833","CVE-2026-56624","CVE-2026-56745","CVE-2026-58061","CVE-2026-58062","CVE-2026-59641","CVE-2026-59645","CVE-2026-59651","CVE-2026-59903","CVE-2026-62243","CVE-2026-65182","CVE-2026-65183","CVE-2026-65637","CVE-2026-65927","CVE-2026-66422","CVE-2026-67213","CVE-2026-67214","CVE-2026-68494","CVE-2026-68495","CVE-2026-68497","CVE-2026-68498","CVE-2026-68525","CVE-2026-68569","CVE-2026-68763","CVE-2026-71888","CVE-2026-71889","CVE-2026-71891","CVE-2026-73086","CVE-2026-73507","CVE-2026-73508","CVE-2026-73634","CVE-2026-73635","CVE-2026-73646","CVE-2026-75140","CVE-2026-75595","CVE-2026-75596","CVE-2026-75975","CVE-2026-76172","CVE-2026-77185","CVE-2026-84292","CVE-2026-84375","CVE-2026-93488","CVE-2026-93491","CVE-2026-93558","CVE-2026-93690","CVE-2026-93748","CVE-2026-93994"]},{"id":"RHSA-2026:69248","title":"Red Hat Security Advisory: Red Hat Developer Hub 1.9.9 release.","vulnerabilityIds":["CVE-2026-19534","CVE-2026-33818","CVE-2026-54272","CVE-2026-55553","CVE-2026-56853","CVE-2026-56858","CVE-2026-56859","CVE-2026-56860","CVE-2026-56862","CVE-2026-67214","CVE-2026-67312","CVE-2026-67422","CVE-2026-69152","CVE-2026-69192","CVE-2026-73086","CVE-2026-75899","CVE-2026-75931","CVE-2026-75975","CVE-2026-76172","CVE-2026-83605","CVE-2026-83607","CVE-2026-83608","CVE-2026-83613","CVE-2026-83614","CVE-2026-83615","CVE-2026-83616","CVE-2026-83619","CVE-2026-84292","CVE-2026-84394","CVE-2026-84961"]},{"id":"RHSA-2026:71543","title":"security update for cockpit-image-builder","vulnerabilityIds":["CVE-2026-75899","CVE-2026-75975","CVE-2026-76172","CVE-2026-84292"]},{"id":"RHSA-2026:95081","title":"Red Hat Security Advisory: Cluster Observability Operator - 1.5","vulnerabilityIds":["CVE-2026-19534","CVE-2026-27145","CVE-2026-33818","CVE-2026-39821","CVE-2026-39822","CVE-2026-39834","CVE-2026-42504","CVE-2026-56853","CVE-2026-56858","CVE-2026-56859","CVE-2026-56860","CVE-2026-56862","CVE-2026-63209","CVE-2026-75838","CVE-2026-75899","CVE-2026-75931","CVE-2026-75975","CVE-2026-76172","CVE-2026-77301","CVE-2026-82417","CVE-2026-84292","CVE-2026-84304","CVE-2026-84375","CVE-2026-84445","CVE-2026-84961","CVE-2026-85152","CVE-2026-87018","CVE-2026-102276","CVE-2026-102278","CVE-2026-109383","CVE-2026-109829","CVE-2026-109855","CVE-2026-109869"]},{"id":"RHSA-2026:87410","title":"Red Hat Security Advisory: RHOAI 2.25.12 - Red Hat OpenShift AI","vulnerabilityIds":["CVE-2024-12224","CVE-2025-14920","CVE-2025-14921","CVE-2025-14924","CVE-2025-14925","CVE-2025-14926","CVE-2025-14927","CVE-2025-14928","CVE-2025-14929","CVE-2025-14930","CVE-2025-61726","CVE-2025-61729","CVE-2026-5241","CVE-2026-5497","CVE-2026-6734","CVE-2026-8643","CVE-2026-9697","CVE-2026-11822","CVE-2026-11824","CVE-2026-12151","CVE-2026-12860","CVE-2026-15143","CVE-2026-15574","CVE-2026-15679","CVE-2026-15925","CVE-2026-16221","CVE-2026-18427","CVE-2026-18446","CVE-2026-18949","CVE-2026-19481","CVE-2026-19484","CVE-2026-19534","CVE-2026-25681","CVE-2026-25960","CVE-2026-27136","CVE-2026-28390","CVE-2026-28684","CVE-2026-31812","CVE-2026-32283","CVE-2026-33186","CVE-2026-33805","CVE-2026-33811","CVE-2026-33814","CVE-2026-34993","CVE-2026-39821","CVE-2026-39852","CVE-2026-39892","CVE-2026-40682","CVE-2026-41178","CVE-2026-42502","CVE-2026-42561","CVE-2026-44431","CVE-2026-44432","CVE-2026-44660","CVE-2026-44705","CVE-2026-45820","CVE-2026-47219","CVE-2026-48526","CVE-2026-48710","CVE-2026-48746","CVE-2026-49114","CVE-2026-49825","CVE-2026-49855","CVE-2026-50559","CVE-2026-54283","CVE-2026-54399","CVE-2026-54428","CVE-2026-55831","CVE-2026-55833","CVE-2026-56121","CVE-2026-56746","CVE-2026-56819","CVE-2026-56853","CVE-2026-56858","CVE-2026-56859","CVE-2026-56860","CVE-2026-56862","CVE-2026-58059","CVE-2026-59296","CVE-2026-59879","CVE-2026-59884","CVE-2026-59885","CVE-2026-59886","CVE-2026-59899","CVE-2026-62243","CVE-2026-62384","CVE-2026-63209","CVE-2026-63374","CVE-2026-65898","CVE-2026-65918","CVE-2026-66007","CVE-2026-67213","CVE-2026-67214","CVE-2026-67312","CVE-2026-68494","CVE-2026-68497","CVE-2026-68770","CVE-2026-69097","CVE-2026-69112","CVE-2026-69152","CVE-2026-69153","CVE-2026-69243","CVE-2026-69244","CVE-2026-71281","CVE-2026-73086","CVE-2026-73088","CVE-2026-73089","CVE-2026-73415","CVE-2026-73417","CVE-2026-73502","CVE-2026-73508","CVE-2026-73620","CVE-2026-73622","CVE-2026-73623","CVE-2026-73624","CVE-2026-73625","CVE-2026-73627","CVE-2026-73646","CVE-2026-75838","CVE-2026-75899","CVE-2026-75931","CVE-2026-75975","CVE-2026-76098","CVE-2026-76169","CVE-2026-76172","CVE-2026-76222","CVE-2026-76905","CVE-2026-77354","CVE-2026-77874","CVE-2026-78676","CVE-2026-78677","CVE-2026-78679","CVE-2026-78682","CVE-2026-79674","CVE-2026-79675","CVE-2026-80205","CVE-2026-81722","CVE-2026-81724","CVE-2026-81727","CVE-2026-82397","CVE-2026-82417","CVE-2026-84292","CVE-2026-84375","CVE-2026-84394","CVE-2026-84428","CVE-2026-84445","CVE-2026-84469","CVE-2026-84504","CVE-2026-84782","CVE-2026-84961","CVE-2026-85124","CVE-2026-85152","CVE-2026-85525","CVE-2026-86049","CVE-2026-86332","CVE-2026-87776","CVE-2026-87817","CVE-2026-87819","CVE-2026-88029","CVE-2026-88031","CVE-2026-89418","CVE-2026-89425","CVE-2026-91777","CVE-2026-91990","CVE-2026-92599","CVE-2026-93599","CVE-2026-93657","CVE-2026-93749","CVE-2026-96749","CVE-2026-102831","CVE-2026-102925","CVE-2026-102930","CVE-2026-102937","CVE-2026-102938","CVE-2026-103262","CVE-2026-104851","CVE-2026-105744"]},{"id":"RHSA-2026:76788","title":"Red Hat Security Advisory: Red Hat Developer Hub 1.10.5 Plugin Catalog GA plugins release.","vulnerabilityIds":["CVE-2026-13697","CVE-2026-19534","CVE-2026-47683","CVE-2026-47686","CVE-2026-47698","CVE-2026-55553","CVE-2026-75899","CVE-2026-75931","CVE-2026-75975","CVE-2026-76172","CVE-2026-77037","CVE-2026-77078","CVE-2026-77413","CVE-2026-77414","CVE-2026-77415","CVE-2026-82333","CVE-2026-82417","CVE-2026-84292","CVE-2026-84375","CVE-2026-84394","CVE-2026-84961","CVE-2026-87776","CVE-2026-88932","CVE-2026-89011","CVE-2026-92934","CVE-2026-92935","CVE-2026-92937","CVE-2026-92938","CVE-2026-92939","CVE-2026-92940","CVE-2026-92941","CVE-2026-92942","CVE-2026-92944","CVE-2026-92946","CVE-2026-92947","CVE-2026-92948","CVE-2026-92950","CVE-2026-92951","CVE-2026-92953","CVE-2026-92954","CVE-2026-92955","CVE-2026-92956","CVE-2026-92957","CVE-2026-92958","CVE-2026-92959","CVE-2026-92960","CVE-2026-92961","CVE-2026-93603","CVE-2026-93604","CVE-2026-93605","CVE-2026-93606"]},{"id":"RHSA-2026:65118","title":"Red Hat Security Advisory: Ansible plug-ins for Red Hat Developer Hub Product Release Update","vulnerabilityIds":["CVE-2026-5079","CVE-2026-67213","CVE-2026-67214","CVE-2026-67313","CVE-2026-67314","CVE-2026-67320","CVE-2026-67321","CVE-2026-73563","CVE-2026-73566","CVE-2026-75838","CVE-2026-75899","CVE-2026-75931","CVE-2026-75975","CVE-2026-76172","CVE-2026-84292","CVE-2026-84394"]},{"id":"RHSA-2026:71179","title":"Red Hat Security Advisory: Red Hat Ansible Automation Platform 2.6 Container Release Update","vulnerabilityIds":["CVE-2025-57847","CVE-2025-66418","CVE-2026-12564","CVE-2026-14257","CVE-2026-15307","CVE-2026-33818","CVE-2026-42215","CVE-2026-42284","CVE-2026-42504","CVE-2026-44244","CVE-2026-49825","CVE-2026-53488","CVE-2026-53492","CVE-2026-54284","CVE-2026-56853","CVE-2026-56858","CVE-2026-56859","CVE-2026-56860","CVE-2026-56862","CVE-2026-59877","CVE-2026-59893","CVE-2026-67322","CVE-2026-67323","CVE-2026-67325","CVE-2026-69152","CVE-2026-69153","CVE-2026-69244","CVE-2026-71458","CVE-2026-71459","CVE-2026-71460","CVE-2026-71462","CVE-2026-71463","CVE-2026-71464","CVE-2026-71465","CVE-2026-71491","CVE-2026-73086","CVE-2026-73620","CVE-2026-73622","CVE-2026-73623","CVE-2026-73624","CVE-2026-73625","CVE-2026-75884","CVE-2026-75899","CVE-2026-75931","CVE-2026-75975","CVE-2026-76172","CVE-2026-76218","CVE-2026-76219","CVE-2026-76220","CVE-2026-76221","CVE-2026-76222","CVE-2026-78676","CVE-2026-78679","CVE-2026-82417","CVE-2026-84292","CVE-2026-84375","CVE-2026-84394","CVE-2026-84470","CVE-2026-84474","CVE-2026-84486","CVE-2026-84499","CVE-2026-84502","CVE-2026-84638","CVE-2026-84643","CVE-2026-84644","CVE-2026-84679","CVE-2026-84680","CVE-2026-84683","CVE-2026-84684","CVE-2026-84686","CVE-2026-84689","CVE-2026-84691","CVE-2026-84692","CVE-2026-84703","CVE-2026-84706","CVE-2026-84707","CVE-2026-84708","CVE-2026-84709","CVE-2026-84711","CVE-2026-84712","CVE-2026-84714","CVE-2026-84716","CVE-2026-84717","CVE-2026-84718","CVE-2026-84719","CVE-2026-84720","CVE-2026-84724","CVE-2026-85393","CVE-2026-87817"]},{"id":"RHSA-2026:68253","title":"Red Hat Security Advisory: Red Hat Edge Manager Version 1.1.4 Security Update","vulnerabilityIds":["CVE-2026-6377","CVE-2026-13149","CVE-2026-25681","CVE-2026-27136","CVE-2026-39820","CVE-2026-39831","CVE-2026-41178","CVE-2026-42306","CVE-2026-42499","CVE-2026-44740","CVE-2026-45819","CVE-2026-46597","CVE-2026-48050","CVE-2026-50162","CVE-2026-56858","CVE-2026-56859","CVE-2026-59869","CVE-2026-69152","CVE-2026-71556","CVE-2026-73088","CVE-2026-73089","CVE-2026-73643","CVE-2026-75899","CVE-2026-75931","CVE-2026-75975","CVE-2026-76172","CVE-2026-81521","CVE-2026-84292","CVE-2026-84375","CVE-2026-84394"]},{"id":"RHSA-2026:68748","title":"Red Hat Security Advisory: General availability of the satellite/iop-advisor-frontend-rhel9 container image","vulnerabilityIds":["CVE-2026-12143","CVE-2026-59869","CVE-2026-67313","CVE-2026-67314","CVE-2026-67320","CVE-2026-67321","CVE-2026-73086","CVE-2026-73088","CVE-2026-73089","CVE-2026-73646","CVE-2026-75899","CVE-2026-75931","CVE-2026-75975","CVE-2026-76172","CVE-2026-84292","CVE-2026-84375","CVE-2026-84394"]},{"id":"RHSA-2026:68747","title":"Red Hat Security Advisory: General availability of the satellite/iop-remediations-rhel9 container image","vulnerabilityIds":["CVE-2026-12143","CVE-2026-44705","CVE-2026-59869","CVE-2026-75899","CVE-2026-75931","CVE-2026-75975","CVE-2026-76172","CVE-2026-82417","CVE-2026-84292","CVE-2026-84375","CVE-2026-84394"]},{"id":"RHSA-2026:67543","title":"Red Hat Security Advisory: Red Hat Advanced Cluster Management for Kubernetes v2.17.2 security update","vulnerabilityIds":["CVE-2026-41178","CVE-2026-45570","CVE-2026-56852","CVE-2026-66780","CVE-2026-71556","CVE-2026-75899","CVE-2026-75931","CVE-2026-75975","CVE-2026-76172","CVE-2026-89060"]},{"id":"RHSA-2026:95591","title":"Red Hat Security Advisory: Cluster Observability Operator - 1.5","vulnerabilityIds":["CVE-2026-19534","CVE-2026-27145","CVE-2026-33818","CVE-2026-39821","CVE-2026-39822","CVE-2026-39834","CVE-2026-42504","CVE-2026-56853","CVE-2026-56858","CVE-2026-56859","CVE-2026-56860","CVE-2026-56862","CVE-2026-63209","CVE-2026-75838","CVE-2026-75899","CVE-2026-75931","CVE-2026-75975","CVE-2026-76172","CVE-2026-77301","CVE-2026-82417","CVE-2026-84292","CVE-2026-84304","CVE-2026-84375","CVE-2026-84445","CVE-2026-84961","CVE-2026-85152","CVE-2026-87018","CVE-2026-102276","CVE-2026-102278","CVE-2026-109383","CVE-2026-109829","CVE-2026-109855","CVE-2026-109869","CVE-2026-116591"]},{"id":"RHSA-2026:68044","title":"Red Hat Security Advisory: Red Hat Edge Manager Version 1.1.4 Security Update","vulnerabilityIds":["CVE-2026-6377","CVE-2026-13149","CVE-2026-25681","CVE-2026-27136","CVE-2026-27145","CVE-2026-33818","CVE-2026-39820","CVE-2026-39831","CVE-2026-41178","CVE-2026-42306","CVE-2026-42499","CVE-2026-42504","CVE-2026-44740","CVE-2026-45819","CVE-2026-46597","CVE-2026-48050","CVE-2026-50162","CVE-2026-56853","CVE-2026-56858","CVE-2026-56859","CVE-2026-56860","CVE-2026-56862","CVE-2026-59869","CVE-2026-69152","CVE-2026-71556","CVE-2026-73088","CVE-2026-73089","CVE-2026-73643","CVE-2026-75899","CVE-2026-75931","CVE-2026-75975","CVE-2026-76172","CVE-2026-81521","CVE-2026-84292","CVE-2026-84375","CVE-2026-84394"]},{"id":"RHSA-2026:68762","title":"Red Hat Security Advisory: General availability of the satellite/iop-advisor-frontend-rhel9 container image","vulnerabilityIds":["CVE-2026-59869","CVE-2026-75899","CVE-2026-75931","CVE-2026-75975","CVE-2026-76172","CVE-2026-84292","CVE-2026-84375","CVE-2026-84394"]},{"id":"RHSA-2026:68754","title":"Red Hat Security Advisory: Red Hat OpenShift Dev Spaces 3.30.1 Release.","vulnerabilityIds":["CVE-2026-4800","CVE-2026-45623","CVE-2026-45819","CVE-2026-47219","CVE-2026-48801","CVE-2026-54272","CVE-2026-55831","CVE-2026-55833","CVE-2026-56745","CVE-2026-56746","CVE-2026-56819","CVE-2026-59887","CVE-2026-59899","CVE-2026-67213","CVE-2026-67312","CVE-2026-67313","CVE-2026-67314","CVE-2026-67320","CVE-2026-67321","CVE-2026-69152","CVE-2026-69153","CVE-2026-69192","CVE-2026-71436","CVE-2026-73086","CVE-2026-73088","CVE-2026-73089","CVE-2026-73508","CVE-2026-73566","CVE-2026-73646","CVE-2026-75899","CVE-2026-75931","CVE-2026-75975","CVE-2026-76172","CVE-2026-82562","CVE-2026-84292","CVE-2026-84375","CVE-2026-84394"]}],"note":"EUVD source date text has no stated timezone and is retained without inventing a UTC instant. Related bulletin membership is not an alias, common cause or applicability claim. A missing vector with a zero score is treated as unrated. Complete vendor/product and underlying source evidence remains in the original JSON."},"key":"euvd:EUVD-2026-64773","identifiers":["EUVD-2026-64773","CVE-2026-76172","GHSA-jqff-g426-hqxp"]},"retained":false,"historicalAffected":[]},{"revision":"23461747d37b460bbe31c0d3c6a6e960","observedAt":"2026-10-25T16:19:04.694+00:00","statement":{"source":"nvd","id":"CVE-2026-76172","aliases":[],"title":"fast-uri is a URI parser for Node.js. During parsing it runs a legacy decoding pass over the scheme component and never re-escapes the result, and serialization writes the scheme back out verbatim, unlike the host component which is re-esca…","description":"fast-uri is a URI parser for Node.js. During parsing it runs a legacy decoding pass over the scheme component and never re-escapes the result, and serialization writes the scheme back out verbatim, unlike the host component which is re-escaped. As a result an input whose scheme carries percent-encoded slashes parses as a scheme with no authority, so the parsed host and error are both undefined, yet resolving or normalizing that same input emits a network-path reference whose authority is attacker-chosen and re-parses to that host. An application that allowlists on the parsed host, or treats a reference with no authority as safe to resolve against its base, gets the opposite of what it checked, giving an off-site redirect, server-side request forgery, or address-policy bypass. The legacy decoder also expands non-standard escape forms, widening the issue past upstream filters, and control characters in the scheme can reach the output as raw carriage return and line feed. The affected versions are 2.3.1 up to but not including 2.4.5, 3.0.0 up to but not including 3.1.6, and 4.0.0 up to but not including 4.1.3. The issue is fixed in 2.4.5, 3.1.6, and 4.1.3, which reject a scheme that is not valid after decoding. Users should upgrade to a patched version.","state":0,"publishedAt":"2026-08-24T11:16:40.723+00:00","modifiedAt":"2026-10-14T13:10:00.187+00:00","affected":[],"metrics":[{"system":"CVSS 3.1 · ce714d77-add3-4f53-aff5-83d477b104bb · Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","score":7.5,"severity":"HIGH"}],"references":["https://cna.openjsf.org/security-advisories.html","https://github.com/fastify/fast-uri/security/advisories/GHSA-jqff-g426-hqxp"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-76172","license":"NIST NVD usage terms; underlying source attribution retained","enrichment":{"sourceStatus":"Analyzed","weaknesses":["CWE-177"],"productCriteria":["cpe:2.3:a:openjsf:fast-uri:*:*:*:*:*:node.js:*:*"],"sourceDates":{"published":"2026-08-24T11:16:40.723","lastModified":"2026-10-14T13:10:00.187"},"relatedAdvisories":[],"note":"NVD analysis and CPE criteria are source context, not proof that a package or your environment is affected. Complete affected data, logical configurations and SSVC are retained in the original JSON."},"key":"nvd:CVE-2026-76172","identifiers":["CVE-2026-76172"]},"retained":false,"historicalAffected":[]},{"revision":"08726a121edf4578a5037de008fea776","observedAt":"2026-10-24T13:17:17.793+00:00","statement":{"source":"osv","id":"GHSA-jqff-g426-hqxp","aliases":["CVE-2026-76172"],"title":"fast-uri vulnerable to host confusion via percent-encoded scheme normalization","description":"### Impact\n\n`fast-uri` decodes percent-encoded characters in the scheme component with the legacy global `unescape()` and serializes the result back as raw characters, without re-escaping it or validating it as a scheme. A scheme that decodes to characters outside the RFC 3986 scheme grammar can therefore introduce structure the original input did not contain.\n\nFor example, `%2f%2fevil.example:/pwn` parses with no authority (`parse().host` is `undefined`), but `resolve()` and `normalize()` return `//evil.example:/pwn`, which reparses with host `evil.example`. The `%uXXXX` form (`%u002f%u002fevil.example:/pwn`) produces the same result, and a scheme containing `%0d%0a` reaches the output as a raw CR LF.\n\nApplications that normalize or resolve untrusted URLs before a redirect check, host allowlist, or outbound request decision, especially ones that treat a missing authority as same-origin, can be steered to an attacker-chosen authority, and a normalized URI placed in a response header can carry an injected CR LF.\n\n### Patches\n\nUpgrade to `fast-uri` >= 4.1.3, or >= 3.1.6 in the v3.x release line, or >= 2.4.5 in the v2.x release line.\n\n### Workarounds\n\nNone. Upgrade to the patched version.","state":0,"publishedAt":"2026-09-02T15:41:53+00:00","modifiedAt":"2026-09-10T03:50:54.4676625+00:00","affected":[{"ecosystem":"npm","name":"fast-uri","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"2.3.1"},{"kind":"fixed","version":"2.4.5"}]}],"versions":[],"rawVersionEvidence":null},{"ecosystem":"npm","name":"fast-uri","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"3.0.0"},{"kind":"fixed","version":"3.1.6"}]}],"versions":[],"rawVersionEvidence":null},{"ecosystem":"npm","name":"fast-uri","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"4.0.0"},{"kind":"fixed","version":"4.1.3"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[{"system":"CVSS_V3","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","score":null,"severity":null},{"system":"Publisher rating","vector":null,"score":null,"severity":"HIGH"}],"references":["https://github.com/fastify/fast-uri/security/advisories/GHSA-jqff-g426-hqxp","https://nvd.nist.gov/vuln/detail/CVE-2026-76172","https://github.com/fastify/fast-uri/commit/37f3417c82994279656854f83ce938acd81c3862","https://github.com/fastify/fast-uri/commit/a941e626411f576f8d90883231e57b6c9d0ff98b","https://github.com/fastify/fast-uri/commit/c6a74bfd9d8c6b0df5362b3c7ae88d8021cb1e39","https://cna.openjsf.org/security-advisories.html","https://github.com/fastify/fast-uri","https://github.com/fastify/fast-uri/releases/tag/v2.4.5","https://github.com/fastify/fast-uri/releases/tag/v3.1.6","https://github.com/fastify/fast-uri/releases/tag/v4.1.3"],"sourceUrl":"https://github.com/advisories/GHSA-jqff-g426-hqxp","license":"GitHub Advisory Database · CC-BY-4.0","key":"osv:GHSA-jqff-g426-hqxp","identifiers":["GHSA-jqff-g426-hqxp","CVE-2026-76172"]},"retained":false,"historicalAffected":[]}],"coverage":[{"source":"cisa-kev:global","scope":"Complete CISA KEV catalog; all vendors. Missing entries do not establish absence of exploitation.","generation":"2026-11-10T05:04:17.0540934+00:00","complete":true,"records":1773,"lastAttemptAt":"2026-11-10T05:04:17.0540934+00:00","lastSuccessAt":"2026-11-10T05:04:18.9657904+00:00","error":null,"lastVerifiedAt":"2026-11-10T05:04:18.9657907+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"cve-program","scope":"Official CVE Program baseline and cumulative hourly delta; all vendors, published and rejected records","generation":"cve-8859cf40d4337e24bd2f258cc7778fbad01bb24c79d057aaf34cf1dfc6f8917d-77fffadfbb8fd9043950d68e58e30483f52900409642c6b646065548479c26cc","complete":true,"records":421868,"lastAttemptAt":"2026-11-10T05:02:16.4823631+00:00","lastSuccessAt":"2026-11-10T05:02:16.4560546+00:00","error":null,"lastVerifiedAt":"2026-11-10T05:02:16.4823631+00:00","snapshotPublishedAt":"2026-11-10T04:28:56+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"euvd","scope":"Rolling EUVD lookups of CVE aliases in current public OSV archives; 500 identifiers per refresh, rechecked after 48 hours. Not a global EUVD catalog. Successful not-found lookups count as checked; they do not imply withdrawal or safety. No reader inventory is sent.","generation":"enrichment-a6dc967b5ceb4c488191e8f172ded5d6","complete":true,"records":13689,"lastAttemptAt":"2026-11-10T05:06:09.4504083+00:00","lastSuccessAt":"2026-11-10T03:04:49.903+00:00","error":null,"lastVerifiedAt":"2026-11-10T03:04:49.903+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":13742,"expectedIdentifiers":13742,"failedIdentifiers":0},{"source":"first-epss:nuget","scope":"FIRST EPSS for explicit CVE aliases in the collected public NuGet archive. Not a global EPSS backfill.","generation":"2026-11-10T05:04:17.0540934+00:00","complete":true,"records":1096,"lastAttemptAt":"2026-11-10T05:04:17.0540934+00:00","lastSuccessAt":"2026-11-10T05:04:18.9669147+00:00","error":null,"lastVerifiedAt":"2026-11-10T05:04:18.9669149+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"nvd","scope":"Rolling NVD lookups of CVE aliases in current public OSV archives; 500 identifiers per refresh, rechecked after 48 hours. Not a global NVD catalog. Successful not-found lookups count as checked; they do not imply withdrawal or safety. No reader inventory is sent.","generation":"enrichment-0cb393c0854647ceaeade74220bf537d","complete":false,"records":13695,"lastAttemptAt":"2026-11-10T05:06:08.8352765+00:00","lastSuccessAt":"2026-11-10T05:06:08.831+00:00","error":"100 identifier lookups failed; latest failures include request timeout. Other identifiers were checked independently.","lastVerifiedAt":"2026-11-10T05:06:08.831+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":13642,"expectedIdentifiers":13742,"failedIdentifiers":100},{"source":"osv:Go","scope":"Complete OSV Go ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"go-cdffb4589856378aa42e8d1bd4a6c74e27a180d8160bf764c44715ef760f0a62","complete":true,"records":9932,"lastAttemptAt":"2026-11-10T05:04:16.277674+00:00","lastSuccessAt":"2026-11-10T00:04:19.8260565+00:00","error":null,"lastVerifiedAt":"2026-11-10T05:04:16.277674+00:00","snapshotPublishedAt":"2026-11-09T23:48:01+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:NuGet","scope":"Complete OSV NuGet ecosystem archive, including GitHub Advisory Database records; NuGet version matching only","generation":"nuget-26503967ae4379db8f374089589d6e03fb15bd31f820c9e992aaf93840c2236c","complete":true,"records":1971,"lastAttemptAt":"2026-11-10T05:02:16.7857429+00:00","lastSuccessAt":"2026-11-09T21:02:20.472473+00:00","error":null,"lastVerifiedAt":"2026-11-10T05:02:16.7857429+00:00","snapshotPublishedAt":"2026-11-09T20:18:18+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:crates.io","scope":"Complete OSV crates.io ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"crates.io-761ecc9061239b0da572dc9254c6f384c1d19339eb08408c436647a2f26129e9","complete":true,"records":3064,"lastAttemptAt":"2026-11-10T05:04:16.6684448+00:00","lastSuccessAt":"2026-11-09T17:05:03.4044794+00:00","error":null,"lastVerifiedAt":"2026-11-10T05:04:16.6684448+00:00","snapshotPublishedAt":"2026-11-09T16:33:20+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:npm","scope":"Complete OSV npm ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"npm-df80ce3f4ee69a086fc0f8e2d917e586081af2af4d81ef20f64f97855436e748","complete":true,"records":231583,"lastAttemptAt":"2026-11-10T05:04:16.1480624+00:00","lastSuccessAt":"2026-11-10T05:04:14.7294031+00:00","error":null,"lastVerifiedAt":"2026-11-10T05:04:16.1480624+00:00","snapshotPublishedAt":"2026-11-10T04:33:09+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null}]}