fast-uri vulnerable to host confusion via backslash authority introducer
Impact
fast-uri v4.1.1 and earlier require a literal // to recognize a URI authority, so a reference that uses \\, /\, or \/ as the authority introducer (in place of //, after an optional scheme) is parsed with no authority: the sequence and everything after it fold into the path. Node's native WHATWG URL (used by fetch(), undici, and Node's http/https clients) instead treats \ as interchangeable with / for special schemes (http, https, ws, wss, ftp, file), so the two parsers extract different hosts from the same input.
For example, fast-uri resolves \\evil.com/path against base https://allowed.com/ to https://allowed.com/%5C%5Cevil.com/path (confined to the trusted host), while Node's WHATWG URL resolves the same reference to https://evil.com/path.
Applications that use fast-uri to enforce host-based policy (allowlists, denylists, loopback/SSRF filtering, redirect validation, outbound proxy routing) before passing the same URL into Node's URL or fetch() consumers see a policy/use desync and can be steered to an unintended destination.
Patches
Upgrade to fast-uri v4.1.2, v3.1.5, v2.4.4.
Workarounds
None. Upgrade to the patched version.
Affected software
Click a technology to see all vulnerabilities affecting it.
| Platform | Package | Vulnerable versions | Fixed in |
|---|---|---|---|
| npm package | fast-uri | < 2.4.4, >= 3.0.0, < 3.1.5, >= 4.0.0, < 4.1.2 | 2.4.4, 3.1.5, 4.1.2 |
References
- https://github.com/fastify/fast-uri/security/advisories/GHSA-7p8r-x3mc-p8w7
- https://nvd.nist.gov/vuln/detail/CVE-2026-18446
- https://github.com/fastify/fast-uri/commit/f3c6c905f47831007490f466c5945012e905cc52
- https://cna.openjsf.org/security-advisories.html
- https://github.com/fastify/fast-uri
- https://github.com/fastify/fast-uri/releases/tag/v4.1.2
- CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N- Weakness (CWE)
CWE-436- Platform
- npm
- Package
fast-uri- Disclosed
- 03.08.2026
- Updated
- 11.10.2026 10:22
Sources and licenses
OSV / GitHub Advisory Database - GHSA-7p8r-x3mc-p8w7 - CC BY 4.0
Vulnerability history: fast-uri
All published vulnerabilities of this package (npm package), newest first. Shows whether this is a one-off slip or a package that needs watching.
- Total entries
- 13
- First → latest
- 05.2026 09.2026
- Without a fix
- 0
- Exploited in attacks
- 0
Severity breakdown
- High 11
- Medium 2
Disclosures per year
- 2026: 13
-
fast-uri vulnerable to host confusion via backslash authority introducer this entry
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.