# CVE-2026-75975: node-ajv: fast-uri is a URI parser for Node.js

CVE-2026-75975 is fixed in 2 products on 1 platform, first by DEBIAN-CVE-2026-75975, released September 10, 2026. It is not reported as exploited. Patch Radar priority: High.

- Web page: https://patchblox.com/security/cve/CVE-2026-75975
- Priority: High
- CVSS: 7.5 (high)
- EPSS: 0.0022
- CISA KEV: not listed
- Exploited (vendor report): no
- Publicly disclosed: no
- Published: Aug 24, 2026

## Description

fast-uri is a URI parser for Node.js. Its custom parser for bracketed IPv6 literals does not validate the complete IPv6 grammar, so invalid trailing text in an authority can be silently discarded and a malformed attacker-controlled host is turned into a different valid IPv6 destination. For example, a bracketed literal with invalid trailing characters is normalized to the unspecified address, which a Node HTTP client then connects to a local service over loopback, and other malformed literals collapse to private-range addresses. No error is set on the parsed result, so an application checking the error field cannot detect the rewrite. An application that normalizes untrusted URLs before outbound requests, redirects, proxy routing, or address-policy enforcement can be redirected to a local or private IPv6 target, giving a server-side request forgery and address-policy bypass primitive. The affected versions are 2.3.1 up to but not including 2.4.5, 3.0.0 up to but not including 3.1.6, and 4.0.0 up to but not including 4.1.3. The issue is fixed in 2.4.5, 3.1.6, and 4.1.3, which validate bracketed IP literals against the full grammar and mark malformed literals as authority errors. Users should upgrade to a patched version.

## Where it's fixed

| Platform | Product | Fixed in | Fix | Released |
|---|---|---|---|---|
| Linux | cockpit-image-builder RHEL 10 | 94.4-1.el10_2 | [RHSA-2026:71543](https://patchblox.com/security/data/fix/linux/rhsa-2026-71543.md) | Sep 25, 2026 |
| Linux | cockpit-image-builder almalinux 10 | 94.4-1.el10_2 | [ALSA-2026:71543](https://patchblox.com/security/data/fix/linux/alsa-2026-71543.md) | Sep 24, 2026 |
| Linux | cockpit-image-builder ol 10 | 0:94.4-1.0.1.el10_2 | [ELSA-2026-71543](https://patchblox.com/security/data/fix/linux/elsa-2026-71543.md) | Sep 24, 2026 |
| Linux | cockpit-image-builder rocky 10 | 0:94.4-1.el10_2 | [RLSA-2026:71543](https://patchblox.com/security/data/fix/linux/rlsa-2026-71543.md) | Sep 25, 2026 |
| Linux | node-ajv Debian 14 | 8.20.0~ds+~cs7.1.4-1 | [DEBIAN-CVE-2026-75975](https://patchblox.com/security/data/fix/linux/debian-cve-2026-75975.md) | Sep 10, 2026 |

---

Data as of 2026-11-08T13:06:02Z UTC. Source: Patchblox Patch Radar (https://patchblox.com/security/patch-radar). Patchblox finds out-of-date software on Windows, macOS and Linux and updates it through release rings: https://patchblox.com/demo

Free to use with attribution: show "Data: Patchblox Patch Radar" with a link to https://patchblox.com/security/patch-radar. Terms, including what needs a written agreement: https://patchblox.com/security/patch-radar/use-the-data

Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.