fast-uri’s IPv6 parsing flaw allows an attacker to supply a malformed bracketed literal that the parser normalizes into a private or unspecified IPv6 address without signaling an error. This silent rewrite means an application that feeds fast-uri‑parsed values to outbound HTTP clients can be redirected to internal or local services, providing a server‑side request forgery and address‑policy bypass. The weakness is an input validation error (CWE‑20) that leads directly to SSRF (CWE‑918).

This issue impacts the fast-uri URI parser for Node.js library versions 2.3.1 through 2.4.4, 3.0.0 through 3.1.5, and 4.0.0 through 4.1.2 in any Node.js application that uses fast-uri to validate or normalize URLs before outbound requests, redirects, proxy configurations, or address‑policy enforcement.

The vulnerability has a CVSS score of 7.5 and is not listed in CISA KEV. The EPSS score is not available, so the current exploitation probability is unknown, but the lack of an error on parsing makes detection difficult. An attacker who controls the input fed to fast-uri—such as a user‑supplied link, a redirect target, or a proxy header—can induce the server to connect to a private‑range or localhost IPv6 address, enabling data exfiltration or internal service hijacking with no authentication requirement. The impact is therefore significant if the application trusts fast-uri‑parsed URLs for outbound traffic.