IPv6 URI Parser Validation Bypass in fast-uri

fast-uri is a URI parser for Node.js. Its custom parser for bracketed IPv6 literals does not validate the complete IPv6 grammar, so invalid trailing text in an authority can be silently discarded and a malformed attacker-controlled host is turned into a different valid IPv6 destination. For example, a bracketed literal with invalid trailing characters is normalized to the unspecified address, which a Node HTTP client then connects to a local service over loopback, and other malformed literals collapse to private-range addresses. No error is set on the parsed result, so an application checking the error field cannot detect the rewrite. An application that normalizes untrusted URLs before outbound requests, redirects, proxy routing, or address-policy enforcement can be redirected to a local or private IPv6 target, giving a server-side request forgery and address-policy bypass primitive. The affected versions are 2.3.1 up to but not including 2.4.5, 3.0.0 up to but not including 3.1.6, an

Casky was already ahead

This CVE exploits attack patterns that Casky's 393matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.

Analysis

The fast-uri Node.js library contains an input validation flaw (CWE-20) in its IPv6 literal parser that fails to enforce complete IPv6 grammar rules. This allows attackers to craft malformed URIs with invalid trailing characters that are silently normalized to unintended IPv6 addresses—most critically the unspecified address (::), which resolves to localhost. Any application using fast-uri to parse user-supplied URIs becomes vulnerable to Server-Side Request Forgery (SSRF) attacks, where an attacker can redirect HTTP clients to local services. This affects Node.js applications across web services, API gateways, and microservices that process external URLs without strict URI validation.

Casky's 393 matching skills leverage Claude's extended reasoning to correlate this vulnerability across Initial Access (TA0001), Execution (TA0043), and Persistence (TA0006) techniques. Practitioners using Casky will observe detection patterns for URL manipulation tactics: malformed authority parsing under CWE-918 (SSRF), abnormal localhost connections following URI processing, and normalization anomalies where invalid IPv6 brackets resolve to unexpected destinations. The platform's security skills would flag suspicious URI patterns, trace data flow from external input through the fast-uri parser to network connections, and identify post-exploitation behaviors like local service enumeration or credential harvesting from loopback interfaces—enabling teams to distinguish benign parsing errors from coordinated attack chains.

Live Threat IntelligenceComing soon

Casky Risk Score

—

EPSS Probability

—

Shodan Exposure

—

GreyNoise Signal

—

Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →

393 Casky skills cover this attack pattern

These skills use Claude AI's reasoning model to surface findings in the same attack categories as CVE-2026-75975.

Abuse of Public-Facing API: Mobile API Abuse

mobile security · low

Run

abusing-dpapi-for-credential-access

red teaming · high

Run

abusing-shadow-credentials-for-privesc

red teaming · high

Run

MITRE ATT&CK Techniques

TA0001 TA0043 TA0006

Investigate the attack patterns behind CVE-2026-75975

Casky has 393 skills that investigate the attack patterns behind CVE-2026-75975. Run one and get CVSS-scored findings in 3 minutes.

Run the skill that detects this →

X Instagram LinkedIn