This behavior creates a Server-Side Request Forgery (SSRF) risk. Applications that rely on fast-uri to normalize user-provided URLs before performing server-side host-policy checks or outbound requests may inadvertently route traffic to internal, private, or loopback IPv6 addresses. Because the library does not set the 'error' property on the parsed result for these malformed inputs, applications that rely on standard error checking will fail to detect the malformation, effectively bypassing security controls that were intended to prevent access to sensitive internal infrastructure.

Impact

Successful exploitation allows an attacker to perform SSRF attacks against internal network resources. By supplying a URL containing a crafted IPv6 host, an attacker can coerce a vulnerable application into performing requests to private or loopback IPv6 addresses that would otherwise be blocked by an allowlist or security middleware. This can lead to unauthorized access to internal administrative interfaces, local services, or sensitive metadata endpoints. The impact is significant for applications that process user-controlled URLs and handle sensitive internal data or administrative tasks.

Recommendation

• Upgrade fast-uri to versions 2.4.5, 3.1.6, or 4.1.3 to remediate CVE-2026-75975, which introduces proper rejection of malformed IPv6 literals.
• Implement a secondary validation layer that rejects or strips user-supplied URLs containing bracketed IPv6 literals if the application does not explicitly require them.
• Configure outbound request handlers to validate hostnames against an explicit, trusted allowlist of IP addresses or FQDNs before initiating the network connection.