Search: CVE-2026-76172

fast-uri, a URI parser for Node.js, has a vulnerability in versions 2.3.1 up to but not including 2.4.5, 3.0.0 up to but not including 3.1.6, and 4.0.0 up to but not including 4.1.3. The issue involves improper handling of percent-encoded slashes in the scheme component, leading to incorrect parsing and potential off-site redirects, server-side request forgery, or address-policy bypass. The flaw is fixed in versions 2.4.5, 3.1.6, and 4.1.3 by rejecting invalid schemes after decoding. Users should upgrade to these patched versions.