CVE-2026-76172
CVE-2026-76172: 1 tracked advisory record across Red Hat. Compare vendor sources and published fix guidance.
Compare the source-linked records below. Ratings and product/version details belong to each advisory; they are not a single CVE-wide score or proof that every listed product is affected. How VulniPulse collects and checks evidence.
Vendor advisory comparison
Red Hat
1 advisory- Advisory severityHigh7.5
High [CVE-2026-76172] URI parsing flaw enables server-side request forgery and redirects
CVE-2026-76172Source published Source updated
fast-uri is a URI parser for Node.js. During parsing it runs a legacy decoding pass over the scheme component and never re-escapes the result, and serialization writes the scheme back out verbatim, unlike the host component which is re-escaped. As a result an input whose scheme carries percent-encoded slashes parses as a scheme with no authority, so the parsed host and error are both undefined, yet resolving or normalizing that same input emits a network-path reference whose authority is attacker-chosen and re-parses to that host. An application that allowlists on the parsed host, or treats a reference with no authority as safe to resolve against its base, gets the opposite of what it checked, giving an off-site redirect, server-side request forgery, or address-policy bypass. The legacy…
- Affected products in this advisory
- Red Hat Enterprise Linux 10
- Cluster Observability Operator 1.5.3
- multicluster engine for Kubernetes 2.11
- multicluster engine for Kubernetes 2.17
32 more entries in the full advisory.
- Source-reported affected versions
- 2.3.1
- 3.0.0
- 4.0.0
- Source-reported fixed versions
- 2.4.5
- 3.1.6
- 4.1.3
- cockpit-image-builder-0:94.4-1.el10_2
46 more entries in the full advisory.
- Mitigation guidance
- There is no mitigation available for this issue. Apply updates as they become available from Red Hat product teams.
Android app · Google Play
Monitor future Red Hat CVEs from your phone.
Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 34 official vendor sources and 160+ reviewed platform categories.