Live › vulnerability › CVE-2026-110180
Go to dashboardfast-uri rewrites the host of http, https, ws and wss URLs without checking the whole input was a valid host, so an authority like 'a@[email protected]' or one with a hidden TAB, CR or LF is silently turned into a different host. An application that checks hosts on one parse and connects using another can be steered to an unintended destination.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:39 UTC, 0h before NVD. All times on this page are UTC.
| Product | Ecosystem | Affected | Fixed in |
|---|
| fast-uri | npm | >= 2.4.2, < 2.4.8 | 2.4.8 |
| fast-uri | npm | >= 3.1.3, < 3.1.9 | 3.1.9 |
| fast-uri | npm | >= 4.0.1, < 4.2.3 | 4.2.3 |
npm ls fast-uri Look for fast-uri versions >= 2.4.2 <= 2.4.7, >= 3.1.3 <= 3.1.8, or >= 4.0.1 <= 4.2.2 in the output2.4.8, 3.1.9, or 4.2.3 (match your major line)Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
fast-uri versions >= 2.4.2, <= 2.4.7, >= 3.1.3, <= 3.1.8, and >= 4.0.1, <= 4.2.2 can silently rewrite the host of an HTTP-family URL (http, https, ws, wss, or any scheme with domainHost: true). For those schemes canonicalizeHost() passes the parsed host to the WHATWG URL parser and adopts its .hostname without checking that the parser read the whole input as a host. RFC 3986 permits @ inside the host group and the WHATWG parser strips TAB, LF, and CR, so the authority fast-uri reports is rewritten by that second parser with no error set: data before an @ is dropped and whitespace is removed.
For example, fast-uri parses http://a@[email protected]/ to host evil.example (dropping the b segment), and a host containing a raw TAB, CR, or LF has those characters stripped. equal() then treats a whitespace-smuggled host as the same as the clean one, and resolve() rewrites the authority the same way.
Applications that use fast-uri to enforce host-based policy (denylists, loopback filtering, redirect validation, outbound proxy routing) on one representation, such as the raw input, see a policy/use desync: the canonical host fast-uri returns differs from what was checked, and traffic can be steered to an unintended destination.
Upgrade to fast-uri 2.4.8, 3.1.9, or 4.2.3.
Reject URIs whose authority contains more than one @, or contains TAB, CR, or LF, before calling fast-uri. Alternatively, treat any non-empty parse(x).error as fatal, and compare hosts only from the same parse() result.
This page as .md · .json · in your agent: get_signal("CVE-2026-110180")
GitHub Advisory Database, CC-BY 4.0 · NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.