CVE-2026-18446 fast-uri CVE debrief

Who should care

Developers and administrators using the fast-uri library for host-based policy enforcement, such as allowlists, SSRF filtering, or redirect validation, should be aware of this vulnerability and take action to address it. This includes reviewing and updating allowlists, SSRF filtering, or redirect validation to ensure correct host-based policy enforcement. Additionally, security teams and vulnerability management teams should be aware of the potential impact of this vulnerability on their systems and take steps to mitigate it. Operators of affected systems should also be aware of the potential for unintended host steering and take steps to verify and address the vulnerability. Platform administrators should review and update their configurations to ensure correct host-based policy enforcement. Vulnerability management teams should prioritize patching or mitigating this vulnerability based on the severity of the potential impact on their systems. Security teams should monitor for and address any potential unintended host steering. Asset owners should verify and document the presence of affected components and prioritize remediation based on risk and exposure. Compliance teams should ensure that affected systems are properly configured and patched to meet regulatory requirements. Incident response teams should be prepared to respond to potential exploitation of this vulnerability. Business stakeholders should be aware of the potential business impact of this vulnerability and prioritize remediation based on risk and exposure. Auditors should verify that affected systems are properly configured and patched to meet regulatory requirements. Penetration testers and red teamers should test for and simulate exploitation of this vulnerability to identify potential vulnerabilities and improve defenses. Blue teamers and defenders should monitor for and detect potential exploitation of this vulnerability and be prepared to respond quickly in case of an incident. Threat hunters should proactively search for signs of exploitation of this vulnerability. Security architects should review and update their architectures to ensure that defenses are in place to prevent exploitation.

Technical summary

The fast-uri library before versions 4.1.2, 3.1.5, and 2.4.4 has a vulnerability where it requires a literal double forward slash to recognize a URI authority. This can lead to applications using fast-uri for host-based policy enforcement being steered to an unintended host. The vulnerability is caused by the library's inability to properly parse URIs with backslash-based introducers. Node's native WHATWG URL parser instead treats a backslash as interchangeable with a forward slash for special schemes, so the two parsers extract different hosts from the same input. To address the vulnerability, developers should upgrade to fast-uri 4.1.2, 3.1.5, or 2.4.4 and review allowlists, SSRF filtering, or redirect validation to ensure correct host-based policy enforcement.

Defensive priority

Upgrade to fast-uri 4.1.2, 3.1.5, or 2.4.4 to address the vulnerability.

Recommended defensive actions

• Upgrade to fast-uri 4.1.2, 3.1.5, or 2.4.4
• Review and update allowlists, SSRF filtering, or redirect validation to ensure correct host-based policy enforcement
• Monitor for and address any potential unintended host steering
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance.
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed.
• Review compensating controls for exposed systems while remediation is scheduled and verified.

Evidence notes

The fast-uri library before versions 4.1.2, 3.1.5, and 2.4.4 has a vulnerability where it requires a literal double forward slash to recognize a URI authority. This can lead to applications using fast-uri for host-based policy enforcement being steered to an unintended host. The vulnerability is caused by the library's inability to properly parse URIs with backslash-based introducers. To verify and address this vulnerability, defenders should review the affected product deployments, update to fast-uri 4.1.2, 3.1.5, or 2.4.4, and ensure correct host-based policy enforcement.

Official resources