{"id":"CVE-2026-110180","aliases":["GHSA-wjr9-j795-jxcr"],"url":"https://o3.security/vulnerability/CVE-2026-110180","summary":"fast-uri vulnerable to host confusion via unchecked WHATWG host canonicalization","details":"### Impact\n\n`fast-uri` versions `>= 2.4.2, <= 2.4.7`, `>= 3.1.3, <= 3.1.8`, and `>= 4.0.1, <= 4.2.2` can silently rewrite the host of an HTTP-family URL (`http`, `https`, `ws`, `wss`, or any scheme with `domainHost: true`). For those schemes `canonicalizeHost()` passes the parsed host to the WHATWG `URL` parser and adopts its `.hostname` without checking that the parser read the whole input as a host. RFC 3986 permits `@` inside the host group and the WHATWG parser strips TAB, LF, and CR, so the authority `fast-uri` reports is rewritten by that second parser with no `error` set: data before an `@` is dropped and whitespace is removed.\n\nFor example, `fast-uri` parses `http://a@b@evil.example/` to host `evil.example` (dropping the `b` segment), and a host containing a raw TAB, CR, or LF has those characters stripped. `equal()` then treats a whitespace-smuggled host as the same as the clean one, and `resolve()` rewrites the authority the same way.\n\nApplications that use `fast-uri` to enforce host-based policy (denylists, loopback filtering, redirect validation, outbound proxy routing) on one representation, such as the raw input, see a policy/use desync: the canonical host `fast-uri` returns differs from what was checked, and traffic can be steered to an unintended destination.\n\n### Patches\n\nUpgrade to `fast-uri` `2.4.8`, `3.1.9`, or `4.2.3`.\n\n### Workarounds\n\nReject URIs whose authority contains more than one `@`, or contains TAB, CR, or LF, before calling `fast-uri`. Alternatively, treat any non-empty `parse(x).error` as fatal, and compare hosts only from the same `parse()` result.","published":"2026-10-20T07:00:42.153Z","modified":"2026-10-24T02:30:41.633960688Z","cvss":{"score":4.8,"severity":"MEDIUM","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N"},"epss":null,"cisaKev":null,"exploitsKnown":null,"affectedPackages":[{"ecosystem":"npm","name":"fast-uri","fixedVersion":"2.4.8"},{"ecosystem":"npm","name":"fast-uri","fixedVersion":"3.1.9"},{"ecosystem":"npm","name":"fast-uri","fixedVersion":"4.2.3"}],"fix":{"url":"https://github.com/fastify/fast-uri/commit/58c183d0b168ad87f98773266444ce1f6375803a","label":"fastify/fast-uri@58c183d"},"references":[{"type":"ADVISORY","url":"https://cna.openjsf.org/security-advisories.html"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/110xxx/CVE-2026-110180.json"},{"type":"ADVISORY","url":"https://github.com/fastify/fast-uri/security/advisories/GHSA-wjr9-j795-jxcr"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-110180"},{"type":"WEB","url":"https://github.com/fastify/fast-uri/commit/58c183d0b168ad87f98773266444ce1f6375803a"},{"type":"WEB","url":"https://github.com/fastify/fast-uri/commit/ddfc6a51122dfce0365655f04479fc3adb7f6b3c"},{"type":"WEB","url":"https://github.com/fastify/fast-uri/commit/f6d46dfeab025d0c440485f4ae29fa4f14707646"},{"type":"PACKAGE","url":"https://github.com/fastify/fast-uri"},{"type":"WEB","url":"https://github.com/fastify/fast-uri/releases/tag/v2.4.8"},{"type":"WEB","url":"https://github.com/fastify/fast-uri/releases/tag/v3.1.9"},{"type":"WEB","url":"https://github.com/fastify/fast-uri/releases/tag/v4.2.3"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-10-24T02:30:41.633960688Z"}}