Is CVE-2026-110180 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-110180 being exploited in the wild.

How severe is CVE-2026-110180?

Medium severity, with a CVSS score of 4.8, published 20 October 2026.

Which products and versions are affected?

fast-uri (npm) >= 2.4.2, < 2.4.8, SEMVER:introduced=2.4.2,fixed=2.4.8; OpenJS Foundation Fast-Uri 2.4.2 through 2.4.7, 3.1.3 through 3.1.8, 4.0.1 through 4.2.2.

How is CVE-2026-110180 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-110180?

Check whether you run fast-uri (npm) or OpenJS Foundation Fast-Uri at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-110180: fast-uri host confusion via unchecked WHATWG canonicalization

Q: Is there a fix for CVE-2026-110180?

Yes. fast-uri (npm): upgrade to 2.4.8 or later. Until then: Reject URIs whose authority contains more than one @ sign, or contains tab, carriage-return, or line-feed characters, before calling fast-uri. Alternatively, treat any non-empty parse error as fatal and compare hosts only from the same parse result. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-110180 attacked?

It is attacked over the network, in a software library.

Q: Am I affected by CVE-2026-110180?

Check whether you run fast-uri (npm) or OpenJS Foundation Fast-Uri at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-110180 · Severity: medium · CVSS 4.8 · Published 2026-10-20

fast-uri is a URI parser library used in Node.js applications to normalize and validate URLs. In affected versions, the library silently rewrites a URL's hostname when parsing certain inputs, causing the canonical hostname to differ from what an application's security checks examined. This allows attackers to bypass host-based access controls like denylists or loopback filtering, steering traffic to unintended destinations.

Technologies: fast-uri (npm). Vendors: npm, OpenJS Foundation.

Quick answers

Is CVE-2026-110180 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-110180 being exploited in the wild.
How severe is CVE-2026-110180?: Medium severity, with a CVSS score of 4.8, published 20 October 2026.
Which products and versions are affected?: fast-uri (npm) >= 2.4.2, < 2.4.8, SEMVER:introduced=2.4.2,fixed=2.4.8; OpenJS Foundation Fast-Uri 2.4.2 through 2.4.7, 3.1.3 through 3.1.8, 4.0.1 through 4.2.2.
Is there a fix for CVE-2026-110180?: Yes. fast-uri (npm): upgrade to 2.4.8 or later. Until then: Reject URIs whose authority contains more than one @ sign, or contains tab, carriage-return, or line-feed characters, before calling fast-uri. Alternatively, treat any non-empty parse error as fatal and compare hosts only from the same parse result. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-110180 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-110180?: Check whether you run fast-uri (npm) or OpenJS Foundation Fast-Uri at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

fast-uri (npm): upgrade to 2.4.8 or later
```
npm install fast-uri@2.4.8
```

Reject URIs whose authority contains more than one @ sign, or contains tab, carriage-return, or line-feed characters, before calling fast-uri. Alternatively, treat any non-empty parse error as fatal and compare hosts only from the same parse result.

Technical details

The canonicalizeHost() function passes the parsed host to the WHATWG URL parser without verifying the parser consumed the entire input. The WHATWG parser drops data before an @ character and strips tab, carriage-return, and line-feed characters, creating a desynchronization between the input and the canonical result. Applications enforcing host-based policy on the raw input can see the canonical host diverge, enabling traffic steering.

Affected products

OpenJS Foundation fast-uri 2.4.2 through 2.4.7, 3.1.3 through 3.1.8, 4.0.1 through 4.2.2

Identifiers

CVE-2026-110180
GHSA-wjr9-j795-jxcr

Timeline

2026-10-19: disclosed
2026-10-20: advisory

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.