fast-uri vulnerable to host confusion via backslash authority introducer (CVE-2026-18446)

fast-uri vulnerable to host confusion via backslash authority introducer (CVE-2026-18446) | HOL Guard CVE

Why this deserves its current priority

CVSS is 7.5. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.

Analysis status

Analysis pending evidence review

Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.

Affected scope and exposure questions

The current feed maps fast-uri (npm), fast-uri (npm), fast-uri (npm), fast-uri (npm) and additional mapped packages. Check affected ranges and fixed versions before updating.

Affected products and reported versions
Product	Affected versions	Fixed versions
cpe:2.3:a:openjsf:fast-uri::::::node.js::*	Not reported	Not reported

Mapped affected packages and fixed versions
Package	Affected range	Fixed version
fast-urinpm	>=4.0.0,<4.1.2	4.1.2
fast-urinpm	<2.4.4	2.4.4
fast-urinpm	>=3.0.0,<3.1.5	3.1.5
fast-urinpm	>=0 <2.4.4	2.4.4
fast-urinpm	>=3.0.0 <3.1.5	3.1.5
fast-urinpm	>=4.0.0 <4.1.2	4.1.2

Recommended response

Check inventory. Check lockfiles and deployed manifests for fast-uri, fast-uri, fast-uri.
Review the reported fix. Update fast-uri to 4.1.2; fast-uri to 2.4.4; fast-uri to 3.1.5; fast-uri to 2.4.4; fast-uri to 3.1.5; fast-uri to 4.1.2 if you use the affected versions. Test the change in a non-production environment first.

Evidence timeline and material changes

Published upstream
Jul 31, 2026
Evidence: source:ghsa:source_dates:source-dates:record
Source modified
Sep 10, 2026
Evidence: source:ghsa:source_dates:source-dates:record
First seen by HOL
Aug 3, 2026

Sources and claim methodology

Upstream source description

### Impact `fast-uri` v4.1.1 and earlier require a literal `//` to recognize a URI authority, so a reference that uses `\\`, `/\`, or `\/` as the authority introducer (in place of `//`, after an optional scheme) is parsed with no authority: the sequence and everything after it fold into the path. Node's native WHATWG `URL` (used by `fetch()`, `undici`, and Node's `http`/`https` clients) instead treats `\` as interchangeable with `/` for special schemes (`http`, `https`, `ws`, `wss`, `ftp`, `file`), so the two parsers extract different hosts from the same input. For example, `fast-uri` resolves `\\evil.com/path` against base `https://allowed.com/` to `https://allowed.com/%5C%5Cevil.com/path` (confined to the trusted host), while Node's WHATWG URL resolves the same reference to `https://evil.com/path`. Applications that use `fast-uri` to enforce host-based policy (allowlists, denylists, loopback/SSRF filtering, redirect validation, outbound proxy routing) before passing the same URL into Node's URL or `fetch()` consumers see a policy/use desync and can be steered to an unintended destination. ### Patches Upgrade to `fast-uri` v4.1.2, v3.1.5, v2.4.4. ### Workarounds None. Upgrade to the patched version.

Quoted source text, attributed separately from HOL analysis.