# CVE-2026-75899: node-ajv: fast-uri is a URI parser for Node.js

CVE-2026-75899 is fixed in 6 products on 1 platform, first by DEBIAN-CVE-2026-75899, released September 10, 2026. It is not reported as exploited. Patch Radar priority: High.

- Web page: https://patchblox.com/security/cve/CVE-2026-75899
- Priority: High
- CVSS: 7.5 (high)
- EPSS: 0.0022
- CISA KEV: not listed
- Exploited (vendor report): no
- Publicly disclosed: no
- Published: Aug 24, 2026

## Description

fast-uri is a URI parser for Node.js. It decodes percent escapes in a hostname during parsing and then decodes the parsed hostname a second time during authority recomposition, so a single call to normalize or resolve can turn nested percent-encoded input into a different network destination such as a loopback hostname or address. For example, a doubly encoded host that spells out a loopback name decodes to that live host in one operation, which contradicts RFC 3986 section 2.4 that an implementation must not decode the same string more than once. An application that normalizes or resolves an untrusted HTTP-family URI before outbound routing, redirect validation, or a host-policy check can receive a destination different from the one the original encoded host represented, giving a server-side request forgery and host-policy bypass primitive. This is an incomplete-fix variant of CVE-2026-6322. The affected versions are 2.4.1 up to but not including 2.4.5, 3.1.2 up to but not including 3.1.6, and 4.0.0 up to but not including 4.1.3. The issue is fixed in 2.4.5, 3.1.6, and 4.1.3, which normalize percent escapes once and preserve encoded percent signs. Users should upgrade to a patched version.

## Where it's fixed

| Platform | Product | Fixed in | Fix | Released |
|---|---|---|---|---|
| Linux | cockpit-image-builder RHEL 10 | 94.4-1.el10_2 | [RHSA-2026:71543](https://patchblox.com/security/data/fix/linux/rhsa-2026-71543.md) | Sep 25, 2026 |
| Linux | cockpit-image-builder almalinux 10 | 94.4-1.el10_2 | [ALSA-2026:71543](https://patchblox.com/security/data/fix/linux/alsa-2026-71543.md) | Sep 24, 2026 |
| Linux | cockpit-image-builder ol 10 | 0:94.4-1.0.1.el10_2 | [ELSA-2026-71543](https://patchblox.com/security/data/fix/linux/elsa-2026-71543.md) | Sep 24, 2026 |
| Linux | cockpit-image-builder rocky 10 | 0:94.4-1.el10_2 | [RLSA-2026:71543](https://patchblox.com/security/data/fix/linux/rlsa-2026-71543.md) | Sep 25, 2026 |
| Linux | node-ajv Debian 14 | 8.20.0~ds+~cs7.1.4-1 | [DEBIAN-CVE-2026-75899](https://patchblox.com/security/data/fix/linux/debian-cve-2026-75899.md) | Sep 10, 2026 |
| Linux | python-jupytext Fedora 43 | 1.19.6-1.fc43 | [FEDORA-2026-3942AB86FD](https://patchblox.com/security/data/fix/linux/fedora-2026-3942ab86fd.md) | Oct 5, 2026 |
| Linux | python-jupytext-doc Fedora 43 | 1.19.6-1.fc43 | [FEDORA-2026-3942AB86FD](https://patchblox.com/security/data/fix/linux/fedora-2026-3942ab86fd.md) | Oct 5, 2026 |
| Linux | python3-jupyterlab-jupytext Fedora 43 | 1.19.6-1.fc43 | [FEDORA-2026-3942AB86FD](https://patchblox.com/security/data/fix/linux/fedora-2026-3942ab86fd.md) | Oct 5, 2026 |
| Linux | python3-jupytext Fedora 43 | 1.19.6-1.fc43 | [FEDORA-2026-3942AB86FD](https://patchblox.com/security/data/fix/linux/fedora-2026-3942ab86fd.md) | Oct 5, 2026 |

---

Data as of 2026-11-08T06:59:42Z UTC. Source: Patchblox Patch Radar (https://patchblox.com/security/patch-radar). Patchblox finds out-of-date software on Windows, macOS and Linux and updates it through release rings: https://patchblox.com/demo

Free to use with attribution: show "Data: Patchblox Patch Radar" with a link to https://patchblox.com/security/patch-radar. Terms, including what needs a written agreement: https://patchblox.com/security/patch-radar/use-the-data

Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.