CVE-2026-18446: fast-uri vulnerable to host confusion via backslash authority introducer
Impact
fast-uri v4.1.1 and earlier require a literal // to recognize a URI authority, so a reference that uses \\, /\, or \/ as the authority introducer (in place of //, after an optional scheme) is parsed with no authority: the sequence and everything after it fold into the path. Node's native WHATWG URL (used by fetch(), undici, and Node's http/https clients) instead treats \ as interchangeable with / for special schemes (http, https, ws, wss, ftp, file), so the two parsers extract different hosts from the same input.
For example, fast-uri resolves \\evil.com/path against base https://allowed.com/ to https://allowed.com/%5C%5Cevil.com/path (confined to the trusted host), while Node's WHATWG URL resolves the same reference to https://evil.com/path.
Applications that use fast-uri to enforce host-based policy (allowlists, denylists, loopback/SSRF filtering, redirect validation, outbound proxy routing) before passing the same URL into Node's URL or fetch() consumers see a policy/use desync and can be steered to an unintended destination.
Patches
Upgrade to fast-uri v4.1.2, v3.1.5, v2.4.4.
Workarounds
None. Upgrade to the patched version.
Other sources
fast-uri before 4.1.2, 3.1.5, and 2.4.4 requires a literal double forward slash to recognize a URI authority, so a reference that uses a backslash based introducer in place of it (backslash backslash, forward slash backslash, or backslash forward slash) is parsed with no authority and folds into the path. Node's native WHATWG URL parser instead treats a backslash as interchangeable with a forward slash for special schemes, so the two parsers extract different hosts from the same input. Applications that use fast-uri to enforce host based policy such as allowlists, SSRF filtering, or redirect validation before passing the same URL into Node's URL or fetch consumers can be steered to an unintended host. Upgrade to fast-uri 4.1.2, 3.1.5, or 2.4.4.
— NVD
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
npm/fast-urito a version that resolves this vulnerability.Fixed in 4.1.2 - Upgrade
Upgrade
npm/fast-urito a version that resolves this vulnerability.Fixed in 3.1.5 - Upgrade
Upgrade
npm/fast-urito a version that resolves this vulnerability.Fixed in 2.4.4 - Upgrade
Upgrade
fast-urito a version that resolves this vulnerability.Fixed in 4.1.2 - Upgrade
Upgrade
fast-urito a version that resolves this vulnerability.Fixed in 3.1.5 - Upgrade
Upgrade
fast-urito a version that resolves this vulnerability.Fixed in 2.4.4
Event History
Frequently Asked Questions
What is the severity of CVE-2026-18446?
CVE-2026-18446 has a high severity rating of 7.5.
How do I fix CVE-2026-18446?
To fix CVE-2026-18446, upgrade fast-uri to version 4.1.2, 3.1.5, or 2.4.4 or later.
What kind of vulnerability is CVE-2026-18446?
CVE-2026-18446 is a host confusion vulnerability related to SSRF.
What does CVE-2026-18446 affect?
CVE-2026-18446 affects fast-uri versions prior to 4.1.2, 3.1.5, and 2.4.4.
What is the risk associated with CVE-2026-18446?
The risk associated with CVE-2026-18446 is rated as 43.