CVE-2026-110180 fast-uri CVE debrief

Who should care

Developers and administrators using fast-uri in their applications, especially those enforcing host-based policies such as denylists, loopback filtering, redirect validation, or outbound proxy routing, should assess their exposure and take necessary actions to mitigate the vulnerability.

Why it matters

The vulnerability in fast-uri allows for host confusion, which can lead to security bypass and potential attacks. Developers and administrators should assess their exposure and take necessary actions to mitigate the vulnerability.

• Traffic can be steered to an unintended destination, potentially bypassing security controls
• Host-based policies may not be effective due to the divergence between the canonical host and the checked host representation
• Applications using fast-uri may be vulnerable to attacks that rely on host confusion

Technical summary

The fast-uri library is vulnerable to host confusion due to unchecked WHATWG host canonicalization. This allows an attacker to steer traffic to an unintended destination by exploiting the divergence between the canonical host and the checked host representation. Affected versions include 2.4.2-2.4.7, 3.1.3-3.1.8, and 4.0.1-4.2.2. The issue is fixed in fast-uri 2.4.8, 3.1.9, and 4.2.3. Applications enforcing host-based policies, such as denylists or loopback filtering, may see the canonical host diverge from what they checked, allowing traffic to be steered to an unintended destination.

Defensive priority

Upgrade to fast-uri version 2.4.8, 3.1.9, or 4.2.3, or later. As a workaround, reject an authority that contains more than one at-sign or any tab, carriage-return, or line-feed before calling fast-uri, or treat any non-empty parse error as fatal and compare hosts only from the same parse result.

Recommended defensive actions

• Upgrade to fast-uri version 2.4.8, 3.1.9, or 4.2.3, or later
• Implement workarounds, such as rejecting authorities with more than one at-sign or certain characters
• Review and update host-based policies, such as denylists and loopback filtering
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed
• Check relevant monitoring, detection, and logs for exposed assets that need extra review

Evidence notes

The CVE record and source item provide details on the vulnerability, including affected versions (2.4.2-2.4.7, 3.1.3-3.1.8, and 4.0.1-4.2.2) and fixed versions (2.4.8, 3.1.9, and 4.2.3). The vendor, fast-uri, has provided information on the issue and the fixes. Evidence is limited to public CVE details and source item data. Defenders should verify affected product deployments, review official advisories, and plan updates or mitigations. They should also review compensating controls and check relevant monitoring, detection, and logs.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.