Double Decoding in URI Parser Enables Host Confusion

fast-uri is a URI parser for Node.js. It decodes percent escapes in a hostname during parsing and then decodes the parsed hostname a second time during authority recomposition, so a single call to normalize or resolve can turn nested percent-encoded input into a different network destination such as a loopback hostname or address. For example, a doubly encoded host that spells out a loopback name decodes to that live host in one operation, which contradicts RFC 3986 section 2.4 that an implementation must not decode the same string more than once. An application that normalizes or resolves an untrusted HTTP-family URI before outbound routing, redirect validation, or a host-policy check can receive a destination different from the one the original encoded host represented, giving a server-side request forgery and host-policy bypass primitive. This is an incomplete-fix variant of CVE-2026-6322. The affected versions are 2.4.1 up to but not including 2.4.5, 3.1.2 up to but not including 3

Casky was already ahead

This CVE exploits attack patterns that Casky's 331matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.

Analysis

fast-uri, a popular Node.js URI parser, contains a critical double-decoding vulnerability that allows attackers to manipulate hostname resolution through nested percent-encoding. During parsing, the library decodes percent-escaped characters in the hostname, then decodes them again during authority recomposition—violating RFC 3986 standards and enabling single-operation transformations that redirect traffic to unintended destinations like loopback addresses. This affects any application using fast-uri to parse untrusted URIs, particularly those handling URL validation, API gateway routing, or security-critical redirects. An attacker can craft doubly-encoded input (e.g., %25%37%30%2e%30%2e%30%2e%31 decoding to 127.0.0.1) to bypass hostname allowlists and access internal services, making this a high-severity supply chain and access control risk.

Casky's 331 matching skills detect this vulnerability through Claude's extended reasoning applied to MITRE ATT&CK techniques TA0001 (Reconnaissance) and TA0006 (Credential Access). Practitioners will observe skill findings that identify URL parsing anomalies indicative of CWE-174 (improper handling of encoded data) and CWE-918 (server-side request forgery patterns). The platform flags suspicious URI normalization behavior—such as multiple decode iterations on single inputs—and highlights traffic destined for loopback or private ranges following hostname resolution. Security teams see correlated events showing encoded input → parsed hostname divergence, alerting them to potential SSRF exploitation or internal network reconnaissance attempts. This contextual visibility enables practitioners to patch fast-uri versions and implement input validation upstream before exploitation occurs.

Live Threat IntelligenceComing soon

Casky Risk Score

—

EPSS Probability

—

Shodan Exposure

—

GreyNoise Signal

—

Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →

331 Casky skills cover this attack pattern

These skills use Claude AI's reasoning model to surface findings in the same attack categories as CVE-2026-75899.

Abuse of Public-Facing API: Mobile API Abuse

mobile security · low

Run

abusing-dpapi-for-credential-access

red teaming · high

Run

abusing-shadow-credentials-for-privesc

red teaming · high

Run

MITRE ATT&CK Techniques

TA0001 TA0006

Investigate the attack patterns behind CVE-2026-75899

Casky has 331 skills that investigate the attack patterns behind CVE-2026-75899. Run one and get CVSS-scored findings in 3 minutes.

Run the skill that detects this →

X Instagram LinkedIn