{"id":"CVE-2026-18446","aliases":["CLSA-2026-1784769612","CLSA-2026-1786636613","CLSA-2026-1787592232","CLSA-2026-1790016280","CLSA-2026-1790604828","CLSA-2026-1790870000","CLSA-2026-1790876894","CLSA-2026-1791814871","CLSA-2026-1792143884","DEBIAN-CVE-2026-18446","EUVD-2026-51553","GHSA-7p8r-x3mc-p8w7","RHSA-2026:49387","RHSA-2026:49401","ROOT-APP-NPM-CVE-2026-18446","UBUNTU-CVE-2026-18446"],"status":"published","title":"fast-uri vulnerable to host confusion via backslash authority introducer","description":"fast-uri before 4.1.2, 3.1.5, and 2.4.4 requires a literal double forward slash to recognize a URI authority, so a reference that uses a backslash based introducer in place of it (backslash backslash, forward slash backslash, or backslash forward slash) is parsed with no authority and folds into the path. Node's native WHATWG URL parser instead treats a backslash as interchangeable with a forward slash for special schemes, so the two parsers extract different hosts from the same input. Applications that use fast-uri to enforce host based policy such as allowlists, SSRF filtering, or redirect validation before passing the same URL into Node's URL or fetch consumers can be steered to an unintended host. Upgrade to fast-uri 4.1.2, 3.1.5, or 2.4.4.","severity":{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.0038,"percentile":0.32306,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-436"],"published":"2026-07-31T14:37:01Z","modified":"2026-11-05T11:15:08Z","fixes":[{"ecosystem":"npm","package":"fast-uri","fixed_in":["2.4.4","3.1.5","4.1.2"],"sources":["ghsa","osv"]},{"ecosystem":"TuxCare:npm","package":"fast-uri","fixed_in":["2.4.3-tuxcare.1","3.1.3-tuxcare.3"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"node-ajv","fixed_in":["8.20.0~ds+~cs7.1.3-1"],"sources":["osv"]},{"ecosystem":"Root:npm","package":"fast-uri","fixed_in":["3.0.1-aikido.5","3.0.2-aikido.6","3.1.0-aikido.6","3.0.6-aikido.5","3.1.2-aikido.3","3.0.1-aikido.6","3.0.1-aikido.7","3.0.6-aikido.4","3.1.0-aikido.5","3.1.2-aikido.2","3.0.2-aikido.3","3.0.2-aikido.4","3.0.2-aikido.5","3.1.3-aikido.2","3.0.3-aikido.5","3.0.6-aikido.6","3.0.3-aikido.6","3.0.3-aikido.7","3.0.1-aikido.8","3.0.3-aikido.8","3.1.2-aikido.4","3.0.3-aikido.9","3.1.3-aikido.3","3.1.5-aikido.1","3.1.5-aikido.2"],"sources":["osv"]},{"ecosystem":"Root:npm","package":"@rootio/fast-uri","fixed_in":["3.0.1-root.io.5","3.0.2-root.io.6","3.1.0-root.io.6","3.0.6-root.io.5","3.1.2-root.io.3","3.0.1-root.io.6","3.0.1-root.io.7","3.0.6-root.io.4","3.1.0-root.io.5","3.1.2-root.io.2","3.0.2-root.io.3","3.0.2-root.io.4","3.0.2-root.io.5","3.1.3-root.io.2","3.0.3-root.io.5","3.0.6-root.io.6","3.0.3-root.io.6","3.0.3-root.io.7","3.0.1-root.io.8","3.0.3-root.io.8","3.1.2-root.io.4","3.0.3-root.io.9","3.1.3-root.io.3","3.1.5-root.io.1","3.1.5-root.io.2"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"npm","package":"fast-uri","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.4"}]}]},{"source":"ghsa","ecosystem":"npm","package":"fast-uri","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.0.0"},{"fixed":"3.1.5"}]}]},{"source":"ghsa","ecosystem":"npm","package":"fast-uri","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.0.0"},{"fixed":"4.1.2"}]}]},{"source":"osv","ecosystem":"TuxCare:npm","package":"fast-uri","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.4.2-tuxcare.0"},{"fixed":"2.4.2-tuxcare.1"}]}],"versions":["2.4.2"],"bundled":6},{"source":"osv","ecosystem":"TuxCare:npm","package":"fast-uri","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.4.3-tuxcare.0"},{"fixed":"2.4.3-tuxcare.1"}]}],"versions":["2.4.3"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"fast-uri","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.0.3-tuxcare.0"},{"fixed":"3.0.3-tuxcare.3"}]}],"versions":["3.0.3","3.0.3-tuxcare.1","3.0.3-tuxcare.2"],"bundled":3},{"source":"osv","ecosystem":"TuxCare:npm","package":"fast-uri","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.1.4-tuxcare.0"},{"fixed":"3.1.4-tuxcare.1"}]}],"versions":["3.1.4"],"bundled":5},{"source":"osv","ecosystem":"TuxCare:npm","package":"fast-uri","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.1.3-tuxcare.0"},{"fixed":"3.1.3-tuxcare.3"}]}],"versions":["3.1.3","3.1.3-tuxcare.1","3.1.3-tuxcare.2"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"fast-uri","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.1.2-tuxcare.0"},{"fixed":"3.1.2-tuxcare.2"}]}],"versions":["3.1.2","3.1.2-tuxcare.1"],"bundled":3},{"source":"osv","ecosystem":"TuxCare:npm","package":"fast-uri","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.1.0-tuxcare.0"},{"fixed":"3.1.0-tuxcare.3"}]}],"versions":["3.1.0","3.1.0-tuxcare.1","3.1.0-tuxcare.2"],"bundled":5},{"source":"osv","ecosystem":"TuxCare:npm","package":"fast-uri","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.0.6-tuxcare.0"},{"fixed":"3.0.6-tuxcare.2"}]}],"versions":["3.0.6","3.0.6-tuxcare.1"],"bundled":7},{"source":"osv","ecosystem":"Debian:13","package":"node-ajv","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["8.12.0~ds+~2.1.1-5","8.17.1~ds+~3.0.1+~3.1.0-1","8.17.1~ds+~3.0.1+~3.1.0-2","8.17.1~ds+~3.0.1+~3.1.0-3","8.17.1~ds+~3.0.1+~3.1.0-4","8.18.0~ds+~cs6.1.1-1","8.18.0~ds+~cs6.1.1-2","8.20.0~ds+~cs6.1.3-1","8.20.0~ds+~cs7.1.2-1","8.20.0~ds+~cs7.1.3-1","8.20.0~ds+~cs7.1.3-2","8.20.0~ds+~cs7.1.3-3","8.20.0~ds+~cs7.1.4-1","8.20.0~ds+~cs7.1.5-1","8.20.0~ds+~cs7.1.6-1"]},{"source":"osv","ecosystem":"Debian:14","package":"node-ajv","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.20.0~ds+~cs7.1.3-1"}]}],"versions":["8.12.0~ds+~2.1.1-5","8.17.1~ds+~3.0.1+~3.1.0-1","8.17.1~ds+~3.0.1+~3.1.0-2","8.17.1~ds+~3.0.1+~3.1.0-3","8.17.1~ds+~3.0.1+~3.1.0-4","8.18.0~ds+~cs6.1.1-1","8.18.0~ds+~cs6.1.1-2","8.20.0~ds+~cs6.1.3-1","8.20.0~ds+~cs7.1.2-1"]},{"source":"osv","ecosystem":"npm","package":"fast-uri","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"2.4.4"}]}]},{"source":"osv","ecosystem":"npm","package":"fast-uri","ranges":[{"type":"SEMVER","events":[{"introduced":"3.0.0"},{"fixed":"3.1.5"}]}]},{"source":"osv","ecosystem":"npm","package":"fast-uri","ranges":[{"type":"SEMVER","events":[{"introduced":"4.0.0"},{"fixed":"4.1.2"}]}]},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"grafana13.1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:13.1.1-0.4.hum1"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"grafana12.4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:12.4.6-0.3.hum1"}]}],"bundled":3},{"source":"osv","ecosystem":"Root:npm","package":"fast-uri","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.1-aikido.5"},{"fixed":"3.0.2-aikido.6"},{"fixed":"3.1.0-aikido.6"},{"fixed":"3.0.6-aikido.5"},{"fixed":"3.1.2-aikido.3"},{"fixed":"3.0.1-aikido.6"},{"fixed":"3.0.1-aikido.7"},{"fixed":"3.0.6-aikido.4"},{"fixed":"3.1.0-aikido.5"},{"fixed":"3.1.2-aikido.2"},{"fixed":"3.0.2-aikido.3"},{"fixed":"3.0.2-aikido.4"},{"fixed":"3.0.2-aikido.5"},{"fixed":"3.1.3-aikido.2"},{"fixed":"3.0.3-aikido.5"},{"fixed":"3.0.6-aikido.6"},{"fixed":"3.0.3-aikido.6"},{"fixed":"3.0.3-aikido.7"},{"fixed":"3.0.1-aikido.8"},{"fixed":"3.0.3-aikido.8"},{"fixed":"3.1.2-aikido.4"},{"fixed":"3.0.3-aikido.9"},{"fixed":"3.1.3-aikido.3"},{"fixed":"3.1.5-aikido.1"},{"fixed":"3.1.5-aikido.2"}]}]},{"source":"osv","ecosystem":"Root:npm","package":"@rootio/fast-uri","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.1-root.io.5"},{"fixed":"3.0.2-root.io.6"},{"fixed":"3.1.0-root.io.6"},{"fixed":"3.0.6-root.io.5"},{"fixed":"3.1.2-root.io.3"},{"fixed":"3.0.1-root.io.6"},{"fixed":"3.0.1-root.io.7"},{"fixed":"3.0.6-root.io.4"},{"fixed":"3.1.0-root.io.5"},{"fixed":"3.1.2-root.io.2"},{"fixed":"3.0.2-root.io.3"},{"fixed":"3.0.2-root.io.4"},{"fixed":"3.0.2-root.io.5"},{"fixed":"3.1.3-root.io.2"},{"fixed":"3.0.3-root.io.5"},{"fixed":"3.0.6-root.io.6"},{"fixed":"3.0.3-root.io.6"},{"fixed":"3.0.3-root.io.7"},{"fixed":"3.0.1-root.io.8"},{"fixed":"3.0.3-root.io.8"},{"fixed":"3.1.2-root.io.4"},{"fixed":"3.0.3-root.io.9"},{"fixed":"3.1.3-root.io.3"},{"fixed":"3.1.5-root.io.1"},{"fixed":"3.1.5-root.io.2"}]}]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"node-ajv","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.0.0-1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"node-ajv","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.10.2-1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"node-ajv","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.12.6-2","6.12.6-3"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"node-ajv","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.12.6-3","8.12.0~ds+~2.1.1-4"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"node-ajv","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["8.17.1~ds+~3.0.1+~3.1.0-4build1","8.20.0~ds+~cs6.1.3-1","8.20.0~ds+~cs7.1.2-1","8.20.0~ds+~cs7.1.3-1","8.20.0~ds+~cs7.1.3-3"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"node-ajv","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["8.12.0~ds+~2.1.1-5","8.17.1~ds+~3.0.1+~3.1.0-2","8.17.1~ds+~3.0.1+~3.1.0-4build1"]}],"products":[{"vendor":"fast-uri","product":"fast-uri"},{"vendor":"openjsf","product":"fast-uri"}],"references":[{"url":"https://github.com/fastify/fast-uri/security/advisories/GHSA-7p8r-x3mc-p8w7","tags":["Vendor Advisory","advisory","web","article","report"]},{"url":"https://cna.openjsf.org/security-advisories.html","tags":["Vendor Advisory","advisory","web","article","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-18446","tags":["advisory"]},{"url":"https://github.com/fastify/fast-uri/commit/f3c6c905f47831007490f466c5945012e905cc52","tags":["web"]},{"url":"https://github.com/fastify/fast-uri/releases/tag/v4.1.2","tags":["web"]},{"url":"https://github.com/advisories/GHSA-7p8r-x3mc-p8w7"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/18xxx/CVE-2026-18446.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-18446","tags":["advisory"]},{"url":"https://github.com/fastify/fast-uri","tags":["package"]},{"url":"https://access.redhat.com/errata/RHSA-2026:49387","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-18446","tags":["report"]},{"url":"https://access.redhat.com/security/updates/classification/","tags":["article"]},{"url":"https://images.redhat.com/","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-67319","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_49387.json","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2509801","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-18446","tags":["advisory","report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2510023","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-67319","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-67319","tags":["advisory"]},{"url":"https://github.com/axios/axios/security/advisories/GHSA-7q8q-rj6j-mhjq","tags":["article"]},{"url":"https://www.vulncheck.com/advisories/axios-before-prototype-pollution-via-nested-option-objects","tags":["article"]},{"url":"https://access.redhat.com/errata/RHSA-2026:49401","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-69198","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_49401.json","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2510803","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-69198","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-69198","tags":["advisory"]},{"url":"https://github.com/beaugunderson/ip-address/commit/488fe9bc7c35363b4b090494fc38c266d217740d","tags":["article"]},{"url":"https://github.com/beaugunderson/ip-address/releases/tag/v10.2.2","tags":["article"]},{"url":"https://github.com/beaugunderson/ip-address/security/advisories/GHSA-4xrf-jv44-h6hh","tags":["article"]},{"url":"https://ubuntu.com/security/CVE-2026-18446","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2026-18446","title":"fast-uri vulnerable to host confusion via backslash authority introducer","description":"fast-uri before 4.1.2, 3.1.5, and 2.4.4 requires a literal double forward slash to recognize a URI authority, so a reference that uses a backslash based introducer in place of it (backslash backslash, forward slash backslash, or backslash forward slash) is parsed with no authority and folds into the path. Node's native WHATWG URL parser instead treats a backslash as interchangeable with a forward slash for special schemes, so the two parsers extract different hosts from the same input. Applications that use fast-uri to enforce host based policy such as allowlists, SSRF filtering, or redirect validation before passing the same URL into Node's URL or fetch consumers can be steered to an unintended host. Upgrade to fast-uri 4.1.2, 3.1.5, or 2.4.4.","status":"published","published":"2026-07-31T14:37:01.584Z","modified":"2026-07-31T17:47:35.325Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high","assessor":"cna"}],"cwes":["CWE-436"],"updated_at":"2026-11-02T14:20:12.60856Z"}],"euvd":[{"id":"EUVD-2026-51553","description":"fast-uri before 4.1.2, 3.1.5, and 2.4.4 requires a literal double forward slash to recognize a URI authority, so a reference that uses a backslash based introducer in place of it (backslash backslash, forward slash backslash, or backslash forward slash) is parsed with no authority and folds into the path. Node's native WHATWG URL parser instead treats a backslash as interchangeable with a forward slash for special schemes, so the two parsers extract different hosts from the same input. Applications that use fast-uri to enforce host based policy such as allowlists, SSRF filtering, or redirect validation before passing the same URL into Node's URL or fetch consumers can be steered to an unintended host. Upgrade to fast-uri 4.1.2, 3.1.5, or 2.4.4.","status":"published","published":"2026-07-31T14:37:01Z","modified":"2026-07-31T17:47:35Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T18:02:25.522444Z"}],"ghsa":[{"id":"GHSA-7p8r-x3mc-p8w7","title":"fast-uri vulnerable to host confusion via backslash authority introducer","description":"### Impact\n\n`fast-uri` v4.1.1 and earlier require a literal `//` to recognize a URI authority, so a reference that uses `\\\\`, `/\\`, or `\\/` as the authority introducer (in place of `//`, after an optional scheme) is parsed with no authority: the sequence and everything after it fold into the path. Node's native WHATWG `URL` (used by `fetch()`, `undici`, and Node's `http`/`https` clients) instead treats `\\` as interchangeable with `/` for special schemes (`http`, `https`, `ws`, `wss`, `ftp`, `file`), so the two parsers extract different hosts from the same input.\n\nFor example, `fast-uri` resolves `\\\\evil.com/path` against base `https://allowed.com/` to `https://allowed.com/%5C%5Cevil.com/path` (confined to the trusted host), while Node's WHATWG URL resolves the same reference to `https://evil.com/path`.\n\nApplications that use `fast-uri` to enforce host-based policy (allowlists, denylists, loopback/SSRF filtering, redirect validation, outbound proxy routing) before passing the same URL into Node's URL or `fetch()` consumers see a policy/use desync and can be steered to an unintended destination.\n\n### Patches\n\nUpgrade to `fast-uri` v4.1.2, v3.1.5, v2.4.4.\n\n### Workarounds\n\nNone. Upgrade to the patched version.","status":"published","published":"2026-08-03T19:16:43Z","modified":"2026-08-03T19:16:43Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high"}],"cwes":["CWE-436"],"updated_at":"2026-11-02T14:40:55.903445Z"}],"nvd":[{"id":"CVE-2026-18446","description":"fast-uri before 4.1.2, 3.1.5, and 2.4.4 requires a literal double forward slash to recognize a URI authority, so a reference that uses a backslash based introducer in place of it (backslash backslash, forward slash backslash, or backslash forward slash) is parsed with no authority and folds into the path. Node's native WHATWG URL parser instead treats a backslash as interchangeable with a forward slash for special schemes, so the two parsers extract different hosts from the same input. Applications that use fast-uri to enforce host based policy such as allowlists, SSRF filtering, or redirect validation before passing the same URL into Node's URL or fetch consumers can be steered to an unintended host. Upgrade to fast-uri 4.1.2, 3.1.5, or 2.4.4.","status":"published","published":"2026-07-31T15:16:27.983Z","modified":"2026-09-02T14:42:38.677Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high","assessor":"secondary"}],"cwes":["CWE-436"],"updated_at":"2026-11-02T14:12:34.290716Z"}],"osv":[{"id":"CVE-2026-18446","title":"fast-uri vulnerable to host confusion via backslash authority introducer","description":"fast-uri before 4.1.2, 3.1.5, and 2.4.4 requires a literal double forward slash to recognize a URI authority, so a reference that uses a backslash based introducer in place of it (backslash backslash, forward slash backslash, or backslash forward slash) is parsed with no authority and folds into the path. Node's native WHATWG URL parser instead treats a backslash as interchangeable with a forward slash for special schemes, so the two parsers extract different hosts from the same input. Applications that use fast-uri to enforce host based policy such as allowlists, SSRF filtering, or redirect validation before passing the same URL into Node's URL or fetch consumers can be steered to an unintended host. Upgrade to fast-uri 4.1.2, 3.1.5, or 2.4.4.","status":"published","published":"2026-07-31T14:37:01.584Z","modified":"2026-10-28T02:30:22.833156684Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high"}],"cwes":["CWE-436"],"updated_at":"2026-11-02T15:44:58.024074Z"},{"id":"DEBIAN-CVE-2026-18446","description":"fast-uri before 4.1.2, 3.1.5, and 2.4.4 requires a literal double forward slash to recognize a URI authority, so a reference that uses a backslash based introducer in place of it (backslash backslash, forward slash backslash, or backslash forward slash) is parsed with no authority and folds into the path. Node's native WHATWG URL parser instead treats a backslash as interchangeable with a forward slash for special schemes, so the two parsers extract different hosts from the same input. Applications that use fast-uri to enforce host based policy such as allowlists, SSRF filtering, or redirect validation before passing the same URL into Node's URL or fetch consumers can be steered to an unintended host. Upgrade to fast-uri 4.1.2, 3.1.5, or 2.4.4.","status":"published","published":"2026-07-31T15:16:27.983Z","modified":"2026-10-01T03:02:29.74866034Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:45:53.097669Z"},{"id":"GHSA-7p8r-x3mc-p8w7","title":"fast-uri vulnerable to host confusion via backslash authority introducer","description":"### Impact\n\n`fast-uri` v4.1.1 and earlier require a literal `//` to recognize a URI authority, so a reference that uses `\\\\`, `/\\`, or `\\/` as the authority introducer (in place of `//`, after an optional scheme) is parsed with no authority: the sequence and everything after it fold into the path. Node's native WHATWG `URL` (used by `fetch()`, `undici`, and Node's `http`/`https` clients) instead treats `\\` as interchangeable with `/` for special schemes (`http`, `https`, `ws`, `wss`, `ftp`, `file`), so the two parsers extract different hosts from the same input.\n\nFor example, `fast-uri` resolves `\\\\evil.com/path` against base `https://allowed.com/` to `https://allowed.com/%5C%5Cevil.com/path` (confined to the trusted host), while Node's WHATWG URL resolves the same reference to `https://evil.com/path`.\n\nApplications that use `fast-uri` to enforce host-based policy (allowlists, denylists, loopback/SSRF filtering, redirect validation, outbound proxy routing) before passing the same URL into Node's URL or `fetch()` consumers see a policy/use desync and can be steered to an unintended destination.\n\n### Patches\n\nUpgrade to `fast-uri` v4.1.2, v3.1.5, v2.4.4.\n\n### Workarounds\n\nNone. Upgrade to the patched version.","status":"published","published":"2026-08-03T19:16:43Z","modified":"2026-09-10T03:50:53.468438344Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high"}],"cwes":["CWE-436"],"updated_at":"2026-11-02T15:46:41.349637Z"},{"id":"RHSA-2026:49387","title":"Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update","status":"published","published":"2026-08-04T10:26:38Z","modified":"2026-10-20T10:10:11Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:53:20.984762Z"},{"id":"RHSA-2026:49401","title":"Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update","status":"published","published":"2026-08-04T10:26:38Z","modified":"2026-10-20T10:10:11Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:53:20.984762Z"},{"id":"UBUNTU-CVE-2026-18446","description":"fast-uri before 4.1.2, 3.1.5, and 2.4.4 requires a literal double forward slash to recognize a URI authority, so a reference that uses a backslash based introducer in place of it (backslash backslash, forward slash backslash, or backslash forward slash) is parsed with no authority and folds into the path. Node's native WHATWG URL parser instead treats a backslash as interchangeable with a forward slash for special schemes, so the two parsers extract different hosts from the same input. Applications that use fast-uri to enforce host based policy such as allowlists, SSRF filtering, or redirect validation before passing the same URL into Node's URL or fetch consumers can be steered to an unintended host. Upgrade to fast-uri 4.1.2, 3.1.5, or 2.4.4.","status":"published","published":"2026-07-31T15:16:00Z","modified":"2026-10-17T12:59:53.726913937Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T16:56:01.334185Z"},{"id":"CLSA-2026-1784769612","title":"TuxCare security update for fast-uri (6 CVEs)","description":"TuxCare rebuilt fast-uri to address 6 CVEs. Fixed in 2.4.2-tuxcare.1.","status":"published","published":"2026-08-04T14:52:48Z","modified":"2026-10-15T09:47:36.429669264Z","updated_at":"2026-11-02T15:43:46.482572Z"},{"id":"CLSA-2026-1786636613","title":"TuxCare security update for dompurify (11 CVEs)","description":"TuxCare rebuilt dompurify to address 11 CVEs. Fixed in 2.4.3-tuxcare.1.","status":"withdrawn","published":"2026-08-13T15:56:53Z","modified":"2026-10-26T13:21:31Z","updated_at":"2026-11-02T15:43:47.20725Z"},{"id":"CLSA-2026-1787592232","title":"TuxCare security update for fast-uri (1 CVE)","description":"TuxCare rebuilt fast-uri to address 1 CVE. Fixed in 2.4.3-tuxcare.1.","status":"published","published":"2026-08-24T17:23:52Z","modified":"2026-10-15T09:45:32.986644767Z","updated_at":"2026-11-02T15:43:47.20725Z"},{"id":"CLSA-2026-1790016280","title":"TuxCare security update for fast-uri (3 CVEs)","description":"TuxCare rebuilt fast-uri to address 3 CVEs. Fixed in 3.0.3-tuxcare.3.","status":"published","published":"2026-09-21T18:44:40Z","modified":"2026-10-15T09:47:14.552239135Z","updated_at":"2026-11-02T15:43:48.28229Z"},{"id":"CLSA-2026-1790604828","title":"TuxCare security update for fast-uri (5 CVEs)","description":"TuxCare rebuilt fast-uri to address 5 CVEs. Fixed in 3.1.4-tuxcare.1.","status":"published","published":"2026-09-28T14:13:48Z","modified":"2026-10-15T09:48:03.133317375Z","updated_at":"2026-11-02T15:43:48.65893Z"},{"id":"CLSA-2026-1790870000","title":"TuxCare security update for fast-uri (1 CVE)","description":"TuxCare rebuilt fast-uri to address 1 CVE. Fixed in 3.1.3-tuxcare.3.","status":"published","published":"2026-10-01T15:53:20Z","modified":"2026-10-15T09:48:04.350869333Z","updated_at":"2026-11-02T15:43:48.65893Z"},{"id":"CLSA-2026-1790876894","title":"TuxCare security update for fast-uri (3 CVEs)","description":"TuxCare rebuilt fast-uri to address 3 CVEs. Fixed in 3.1.2-tuxcare.2.","status":"published","published":"2026-10-01T17:48:14Z","modified":"2026-10-15T09:48:04.328063614Z","updated_at":"2026-11-02T15:43:48.65893Z"},{"id":"CLSA-2026-1791814871","title":"TuxCare security update for fast-uri (5 CVEs)","description":"TuxCare rebuilt fast-uri to address 5 CVEs. Fixed in 3.1.0-tuxcare.3.","status":"published","published":"2026-10-12T14:21:11Z","modified":"2026-10-15T09:47:40.140546262Z","updated_at":"2026-11-02T15:43:50.599064Z"},{"id":"CLSA-2026-1792143884","title":"TuxCare security update for fast-uri (7 CVEs)","description":"TuxCare rebuilt fast-uri to address 7 CVEs. Fixed in 3.0.6-tuxcare.2.","status":"published","published":"2026-10-16T09:44:44Z","modified":"2026-10-16T12:15:03.199589181Z","updated_at":"2026-11-02T15:43:50.949147Z"},{"id":"ROOT-APP-NPM-CVE-2026-18446","title":"CVE-2026-18446 in fast-uri - Patched by Root","description":"Root has patched CVE-2026-18446 in the fast-uri package for Root:npm. Multiple fixed versions available.","status":"published","published":"2026-11-05T10:50:51Z","modified":"2026-11-05T11:15:08.183121963Z","updated_at":"2026-11-05T13:30:49.23793Z"}]}}