# CVE-2026-110180: fast-uri host confusion via unchecked WHATWG canonicalization

Source: https://junglewise.ai/threats/cve-2026-110180-fast-uri-is-a-dependency-free-rfc-3986-uri-parser-and-serializer  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-20. Updated: 2026-10-20  
License: CC BY 4.0 with a link back

CVE-2026-110180 · Severity: medium · CVSS 4.8 · Published 2026-10-20

fast-uri is a URI parser library used in Node.js applications to normalize and validate URLs. In affected versions, the library silently rewrites a URL's hostname when parsing certain inputs, causing the canonical hostname to differ from what an application's security checks examined. This allows attackers to bypass host-based access controls like denylists or loopback filtering, steering traffic to unintended destinations.

Technologies: [fast-uri (npm)](https://junglewise.ai/threats/technologies/npm-fast-uri). Vendors: [npm](https://junglewise.ai/threats/vendors/npm), [OpenJS Foundation](https://junglewise.ai/threats/vendors/openjs-foundation).

## Quick answers

**Is CVE-2026-110180 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-110180 being exploited in the wild.

**How severe is CVE-2026-110180?** Medium severity, with a CVSS score of 4.8, published 20 October 2026.

**Which products and versions are affected?** fast-uri (npm) >= 2.4.2, < 2.4.8, SEMVER:introduced=2.4.2,fixed=2.4.8; OpenJS Foundation Fast-Uri 2.4.2 through 2.4.7, 3.1.3 through 3.1.8, 4.0.1 through 4.2.2.

**Is there a fix for CVE-2026-110180?** Yes. fast-uri (npm): upgrade to 2.4.8 or later. Until then: Reject URIs whose authority contains more than one @ sign, or contains tab, carriage-return, or line-feed characters, before calling fast-uri. Alternatively, treat any non-empty parse error as fatal and compare hosts only from the same parse result. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-110180 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-110180?** Check whether you run fast-uri (npm) or OpenJS Foundation Fast-Uri at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- fast-uri (npm): upgrade to 2.4.8 or later

  ```sh
  npm install fast-uri@2.4.8
  ```


Reject URIs whose authority contains more than one @ sign, or contains tab, carriage-return, or line-feed characters, before calling fast-uri. Alternatively, treat any non-empty parse error as fatal and compare hosts only from the same parse result.

## Technical details

The canonicalizeHost() function passes the parsed host to the WHATWG URL parser without verifying the parser consumed the entire input. The WHATWG parser drops data before an @ character and strips tab, carriage-return, and line-feed characters, creating a desynchronization between the input and the canonical result. Applications enforcing host-based policy on the raw input can see the canonical host diverge, enabling traffic steering.

## Affected products

- OpenJS Foundation fast-uri 2.4.2 through 2.4.7, 3.1.3 through 3.1.8, 4.0.1 through 4.2.2

## Identifiers

- CVE-2026-110180
- GHSA-wjr9-j795-jxcr

## Timeline

- 2026-10-19: disclosed
- 2026-10-20: advisory

## References

- [https://cna.openjsf.org/security-advisories.html](https://cna.openjsf.org/security-advisories.html)
- [https://github.com/fastify/fast-uri/security/advisories/GHSA-wjr9-j795-jxcr](https://github.com/fastify/fast-uri/security/advisories/GHSA-wjr9-j795-jxcr)

## Related threats

- [fast-uri vulnerable to scheme injection via an unescaped first-segment colon in suffix references](https://junglewise.ai/threats/cve-2026-110725-fast-uri-is-a-dependency-free-rfc-3986-uri-parser-and-serializer)
- [fast-uri URI scheme spoofing via percent-encoded scheme](https://junglewise.ai/threats/cve-2026-110306-fast-uri-is-a-dependency-free-rfc-3986-uri-parser-and-serializer)
- [fast-uri vulnerable to improper path equivalence in relative reference normalization](https://junglewise.ai/threats/cve-2026-110095-fast-uri-is-a-dependency-free-rfc-3986-uri-parser-and-serializer)
- [fast-uri mailto header injection via percent-encoded field-name desynchronization](https://junglewise.ai/threats/cve-2026-86818-fast-uri-mailto-header-injection-via-percent-encoded-field-name)
- [fast-uri inconsistent host case normalization via percent-encoded octets](https://junglewise.ai/threats/cve-2026-86472-fast-uri-inconsistent-host-case-normalization-via-percent-encoded)