URI Parser Scheme Encoding Bypass in Node.js

CVE-2026-76172 is a URI parsing vulnerability in the fast-uri Node.js library that stems from inconsistent handling of percent-encoded characters in the scheme component. The parser applies legacy decoding to the scheme but fails to re-escape the result during serialization, unlike other URI components such as the host. This creates a dangerous discrepancy where specially crafted URIs with percent-encoded slashes in the scheme can be parsed as having an undefined authority and host, yet when resolved or normalized, the same input produces a network-path reference with an attacker-controlled authority. Any application using fast-uri to parse or validate URIs—particularly those handling user-supplied input for URL routing, API endpoints, or security policy enforcement—faces potential authorization bypass, open redirect, or request smuggling attacks. This affects Node.js developers across web frameworks, API gateways, and security tools that rely on this library for URI validation.

While this CVE does not map directly to MITRE ATT&CK techniques, Casky's Claude-powered analysis engine would identify the underlying attack patterns by examining CWE-177 (Improper Handling of Encoding or Decoding of Data) across the 754 mapped security skills. Practitioners using Casky would observe findings related to input validation failures, improper canonicalization of user-controlled data, and inconsistent encoding/decoding logic—patterns commonly associated with CWE-177 violations. The platform would flag the discrepancy between parsing and serialization behavior as a potential security control bypass, highlighting how attackers could craft malicious URIs to evade URL-based access controls, bypass CORS policies, or trigger unintended network requests. Security teams would receive specific recommendations to audit URI handling logic, implement strict input validation before parsing, and ensure consistent re-escaping of all URI components during serialization.