# CVE-2026-18446: fast-uri host confusion via backslash authority introducer

Source: https://junglewise.ai/threats/cve-2026-18446-fast-uri-host-confusion-via-backslash-authority-introducer  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-31. Updated: 2026-08-03  
License: CC BY 4.0 with a link back

CVE-2026-18446 · Severity: high · CVSS 7.5 · Published 2026-07-31

A vulnerability in the fast-uri library, a tool used for high-performance web address parsing, can lead to security bypasses. Because this library interprets certain characters (like backslashes) differently than standard web browsers and Node.js, an attacker can craft a malicious link that appears safe to security filters but directs users or data to a malicious destination. This could allow attackers to bypass access controls, redirect users to phishing sites, or perform Server-Side Request Forgery (SSRF) attacks.

Technologies: [fast-uri (npm)](https://junglewise.ai/threats/technologies/npm-fast-uri). Vendors: [npm](https://junglewise.ai/threats/vendors/npm).

## Quick answers

**Is CVE-2026-18446 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-18446 being exploited in the wild.

**How severe is CVE-2026-18446?** High severity, with a CVSS score of 7.5, published 31 July 2026.

**Which products and versions are affected?** fast-uri (npm) SEMVER:introduced=0,fixed=2.4.4.

**Is there a fix for CVE-2026-18446?** Yes. fast-uri (npm): upgrade to 2.4.4 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-18446 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-18446?** Check whether you run fast-uri (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- fast-uri (npm): upgrade to 2.4.4 or later

  ```sh
  npm install fast-uri@2.4.4
  ```


## Technical details

The fast-uri library (v4.1.1 and earlier) fails to recognize backslashes ('\\') as valid authority introducers, whereas Node.js's WHATWG URL parser treats them as interchangeable with forward slashes ('/') for special schemes like http and https. This creates an interpretation conflict (CWE-436) where fast-uri may parse a malicious URI as a relative path on a trusted host, while the underlying Node.js client (fetch, http, etc.) treats it as a different, potentially malicious host. Attackers can exploit this desync to bypass host-based security policies such as allowlists, redirect validation, and SSRF filters. The issue is resolved in versions 4.1.2, 3.1.5, and 2.4.4.

## Affected products

- fastify fast-uri < 2.4.4, >= 3.0.0 < 3.1.5, >= 4.0.0 < 4.1.2

## Identifiers

- CVE-2026-18446
- GHSA-7p8r-x3mc-p8w7

## Timeline

- 2026-07-31: patched: Fixes released in multiple branches
- 2026-07-31: disclosed: NVD publication date
- 2026-08-03: advisory: GitHub Advisory published

## References

- [https://api.github.com/users/alanturing881](https://api.github.com/users/alanturing881)
- [https://github.com/alanturing881](https://github.com/alanturing881)
- [https://api.github.com/users/alanturing881/gists%7B/gist_id%7D](https://api.github.com/users/alanturing881/gists%7B/gist_id%7D)
- [https://api.github.com/users/alanturing881/repos](https://api.github.com/users/alanturing881/repos)
- [https://avatars.githubusercontent.com/u/286391906?v=4](https://avatars.githubusercontent.com/u/286391906?v=4)
- [https://api.github.com/users/alanturing881/events%7B/privacy%7D](https://api.github.com/users/alanturing881/events%7B/privacy%7D)

## Related threats

- [fast-uri vulnerable to scheme injection via an unescaped first-segment colon in suffix references](https://junglewise.ai/threats/cve-2026-110725-fast-uri-is-a-dependency-free-rfc-3986-uri-parser-and-serializer)
- [fast-uri URI scheme spoofing via percent-encoded scheme](https://junglewise.ai/threats/cve-2026-110306-fast-uri-is-a-dependency-free-rfc-3986-uri-parser-and-serializer)
- [fast-uri host confusion via unchecked WHATWG canonicalization](https://junglewise.ai/threats/cve-2026-110180-fast-uri-is-a-dependency-free-rfc-3986-uri-parser-and-serializer)
- [fast-uri vulnerable to improper path equivalence in relative reference normalization](https://junglewise.ai/threats/cve-2026-110095-fast-uri-is-a-dependency-free-rfc-3986-uri-parser-and-serializer)
- [fast-uri mailto header injection via percent-encoded field-name desynchronization](https://junglewise.ai/threats/cve-2026-86818-fast-uri-mailto-header-injection-via-percent-encoded-field-name)