CVE-2026-18446: fast-uri host confusion via backslash authority introducer

CVE-2026-18446 · Severity: high · CVSS 7.5 · Published 2026-07-31

A vulnerability in the fast-uri library, a tool used for high-performance web address parsing, can lead to security bypasses. Because this library interprets certain characters (like backslashes) differently than standard web browsers and Node.js, an attacker can craft a malicious link that appears safe to security filters but directs users or data to a malicious destination. This could allow attackers to bypass access controls, redirect users to phishing sites, or perform Server-Side Request Forgery (SSRF) attacks.

Technologies: fast-uri (npm). Vendors: npm.

Quick answers

Is CVE-2026-18446 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-18446 being exploited in the wild.
How severe is CVE-2026-18446?
High severity, with a CVSS score of 7.5, published 31 July 2026.
Which products and versions are affected?
fast-uri (npm) SEMVER:introduced=0,fixed=2.4.4.
Is there a fix for CVE-2026-18446?
Yes. fast-uri (npm): upgrade to 2.4.4 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-18446 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-18446?
Check whether you run fast-uri (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • fast-uri (npm): upgrade to 2.4.4 or later
    npm install fast-uri@2.4.4

Technical details

The fast-uri library (v4.1.1 and earlier) fails to recognize backslashes ('\\') as valid authority introducers, whereas Node.js's WHATWG URL parser treats them as interchangeable with forward slashes ('/') for special schemes like http and https. This creates an interpretation conflict (CWE-436) where fast-uri may parse a malicious URI as a relative path on a trusted host, while the underlying Node.js client (fetch, http, etc.) treats it as a different, potentially malicious host. Attackers can exploit this desync to bypass host-based security policies such as allowlists, redirect validation, and SSRF filters. The issue is resolved in versions 4.1.2, 3.1.5, and 2.4.4.

Affected products

  • fastify fast-uri < 2.4.4, >= 3.0.0 < 3.1.5, >= 4.0.0 < 4.1.2

Identifiers

  • CVE-2026-18446
  • GHSA-7p8r-x3mc-p8w7

Timeline

  • 2026-07-31: patched: Fixes released in multiple branches
  • 2026-07-31: disclosed: NVD publication date
  • 2026-08-03: advisory: GitHub Advisory published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.