CVE-2026-18446
Received Received - Intake

fast-uri Authority Parsing Bypass via Backslash

Publication date: 2026-07-31

Last updated on: 2026-07-31

Assigner: openjs

Description
fast-uri before 4.1.2, 3.1.5, and 2.4.4 requires a literal double forward slash to recognize a URI authority, so a reference that uses a backslash based introducer in place of it (backslash backslash, forward slash backslash, or backslash forward slash) is parsed with no authority and folds into the path. Node's native WHATWG URL parser instead treats a backslash as interchangeable with a forward slash for special schemes, so the two parsers extract different hosts from the same input. Applications that use fast-uri to enforce host based policy such as allowlists, SSRF filtering, or redirect validation before passing the same URL into Node's URL or fetch consumers can be steered to an unintended host. Upgrade to fast-uri 4.1.2, 3.1.5, or 2.4.4.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-31
Last Modified
2026-07-31
Generated
2026-07-31
AI Q&A
2026-07-31
EPSS Evaluated
N/A
NVD
CVE-2026-18446
EUVD
EUVD-2026-51553

Affected Vendors & Products

Currently, no data is known.

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-436 Product A handles inputs or steps differently than Product B, which causes A to perform incorrect actions based on its perception of B's state.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

The vulnerability in fast-uri versions before 4.1.2, 3.1.5, and 2.4.4 involves incorrect parsing of URIs with backslashes instead of forward slashes in the authority part. This causes the parser to misinterpret the host, potentially bypassing security policies like allowlists or SSRF filters. Node's native parser handles backslashes differently, leading to inconsistent host extraction.

Detection Guidance

This vulnerability is specific to the fast-uri library and requires checking the installed version of the library in your project dependencies. Use commands like 'npm list fast-uri' or 'yarn list fast-uri' to check the version. If the version is below 4.1.2, 3.1.5, or 2.4.4, the system is vulnerable.

Impact Analysis

This vulnerability can allow attackers to bypass security controls such as host-based allowlists, SSRF protections, or redirect validations. If your application uses fast-uri for policy enforcement before passing URLs to Node's URL or fetch APIs, an attacker could manipulate URLs to access unintended hosts or services.

Compliance Impact

This vulnerability does not directly affect compliance with standards like GDPR or HIPAA as it relates to URI parsing inconsistencies between libraries rather than data protection or privacy controls.

Mitigation Strategies

Upgrade the fast-uri library to version 4.1.2, 3.1.5, or 2.4.4 or later. For Node.js projects, run 'npm update fast-uri' or 'yarn upgrade fast-uri'. Review applications using fast-uri for host-based policies to ensure they are not affected by the parsing discrepancy.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-18446. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart