CVE-2026-75975
CVE-2026-75975: 1 tracked advisory record across Red Hat. Compare vendor sources and published fix guidance.
Compare the source-linked records below. Ratings and product/version details belong to each advisory; they are not a single CVE-wide score or proof that every listed product is affected. How VulniPulse collects and checks evidence.
Vendor advisory comparison
Red Hat
1 advisory- Advisory severityHigh7.5
High [CVE-2026-75975] Server-side request forgery via malformed IPv6 normalization
CVE-2026-75975Source published Source updated
fast-uri is a URI parser for Node.js. Its custom parser for bracketed IPv6 literals does not validate the complete IPv6 grammar, so invalid trailing text in an authority can be silently discarded and a malformed attacker-controlled host is turned into a different valid IPv6 destination. For example, a bracketed literal with invalid trailing characters is normalized to the unspecified address, which a Node HTTP client then connects to a local service over loopback, and other malformed literals collapse to private-range addresses. No error is set on the parsed result, so an application checking the error field cannot detect the rewrite. An application that normalizes untrusted URLs before outbound requests, redirects, proxy routing, or address-policy enforcement can be redirected to a…
- Affected products in this advisory
- Red Hat Enterprise Linux 10
- Red Hat Satellite 6.19 for RHEL 9
- Cluster Observability Operator 1.5.3
- multicluster engine for Kubernetes 2.11
33 more entries in the full advisory.
- Source-reported affected versions
- 2.3.1
- 3.0.0
- 4.0.0
- Source-reported fixed versions
- 2.4.5
- 3.1.6
- 4.1.3
- cockpit-image-builder-0:94.4-1.el10_2
46 more entries in the full advisory.
- Mitigation guidance
- Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability. Until updates are available, restrict the processing of user-supplied URIs to trusted sources only, implement strict allowlists for destination hosts (preferably IP-based rather than hostname-based), and apply egress filtering to prevent server-initiated connections to internal networks or cloud metadata services.
Android app · Google Play
Monitor future Red Hat CVEs from your phone.
Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 34 official vendor sources and 160+ reviewed platform categories.