CVE-2026-110180
Awaiting Analysis Awaiting Analysis - Queue

URI Authority Rewriting in fast-uri

Publication date: 2026-10-20

Last updated on: 2026-10-20

Assigner: openjs

Description
fast-uri is a dependency-free RFC 3986 URI parser and serializer for Node.js. In versions from 2.4.2 through 2.4.7, from 3.1.3 through 3.1.8, and from 4.0.1 through 4.2.2, for HTTP-family schemes the canonicalizeHost() function passes the parsed host to the WHATWG URL parser and adopts its hostname without checking that the parser consumed the entire input as a host, so the authority can be silently rewritten: data before an at-sign is dropped and tab, carriage-return, and line-feed characters are stripped, with no error reported. An application that enforces host-based policy such as denylists, loopback filtering, redirect validation, or outbound proxy routing on one representation can then see the canonical host diverge from what it checked, allowing traffic to be steered to an unintended destination. The issue is fixed in fast-uri 2.4.8, 3.1.9, and 4.2.3, and users should upgrade to one of these versions or later. As a workaround, reject an authority that contains more than one at-sign or any tab, carriage-return, or line-feed before calling fast-uri, or treat any non-empty parse error as fatal and compare hosts only from the same parse result.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-20
Last Modified
2026-10-20
Generated
2026-11-09
AI Q&A
2026-10-20
EPSS Evaluated
2026-11-08
NVD
CVE-2026-110180
EUVD
EUVD-2026-104813

Affected Vendors & Products

Showing 3 associated CPEs
Vendor Product Version / Range
fast-uri fast-uri 2.4.2
fast-uri fast-uri 3.1.3
fast-uri fast-uri 4.0.1

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-436 Product A handles inputs or steps differently than Product B, which causes A to perform incorrect actions based on its perception of B's state.
CWE-20 The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability affects the fast-uri library in Node.js. It allows the host part of a URL to be silently rewritten by the WHATWG URL parser, bypassing host-based policies. This happens because the parser strips whitespace and processes the host incorrectly, causing a mismatch between the raw input and the canonical host. Affected versions are 2.4.2-2.4.7, 3.1.3-3.1.8, and 4.0.1-4.2.2.

Detection Guidance

Check the version of fast-uri in your Node.js project using 'npm list fast-uri' or 'yarn list fast-uri'. If the version is between 2.4.2-2.4.7, 3.1.3-3.1.8, or 4.0.1-4.2.2, the system is vulnerable. Inspect HTTP traffic for URIs with multiple @ symbols or whitespace in the authority section as these may indicate exploitation attempts.

Monitor for unexpected host rewrites in logs or network traffic analysis tools. Test applications by sending crafted URIs with tabs, carriage returns, or line feeds in the host part to observe if the host is incorrectly parsed.

Impact Analysis

This vulnerability could allow traffic to be redirected to unintended destinations. Applications enforcing host-based policies like denylists, loopback filtering, or proxy routing may fail to block malicious URLs due to the rewritten host. Exploitation requires no privileges or user interaction.

Compliance Impact

This vulnerability could potentially affect compliance with standards like GDPR and HIPAA by allowing unauthorized data exfiltration or access to systems. Host-based policies such as denylists or loopback filtering may be bypassed, enabling traffic to unintended destinations. This could lead to data breaches or unauthorized access, violating confidentiality and integrity requirements in GDPR and HIPAA.

Mitigation Strategies

Upgrade fast-uri to version 2.4.8 or later, 3.1.9 or later, or 4.2.3 or later immediately. If upgrading is not possible, implement input validation to reject URIs with multiple @ symbols or whitespace in the authority section before parsing.

Treat non-empty parse errors as fatal and ensure host comparisons are performed only on the same parse result. Review and update host-based policies such as denylists, loopback filtering, and redirect validation to account for potential host rewrites.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-110180. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...