CVE-2026-18446 Host Confusion in fast-uri

The fast-uri package (versions < 2.4.4, 3.0.0-3.1.5, and 4.0.0-4.1.2) is vulnerable to a URI parsing desync (CVE-2026-18446). While Node's native WHATWG URL parser treats backslashes as valid authority separators for special schemes like http and https, fast-uri fails to recognize these non-standard authority introducers.

This inconsistency allows an attacker to supply a URI reference containing backslashes (e.g., \\evil.com/path). fast-uri treats the sequence as part of the path, causing security validation logic (like SSRF filters or allowlists) to perceive the request as targeting the trusted origin. Conversely, when the downstream fetch() or http client consumes the same URI, it interprets the sequence as a cross-origin host, effectively bypassing the security controls. This vulnerability is critical for applications that rely on fast-uri to perform host-based policy enforcement before passing requests to standard Node.js networking primitives.

Impact

Successful exploitation allows for the bypass of security controls including SSRF protection, loopback filtering, redirect validation, and outbound proxy routing. If an application uses fast-uri to validate an input URL before passing it to fetch(), an attacker can reach arbitrary external endpoints, potentially exfiltrating internal data, interacting with internal services, or bypassing egress restrictions.

Recommendation

• Update the fast-uri dependency to versions 2.4.4, 3.1.5, or 4.1.2 immediately to receive the patch.
• Audit applications using fast-uri for security validation to ensure they do not perform security-critical decisions on URLs before passing them to native Node.js URL consumers.
• Implement uniform URI parsing throughout the request lifecycle by preferring native Node.js URL APIs if strict fast-uri compatibility is not required for performance reasons.