{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","feed_url":"https://feed.craftedsignal.io/products/fast-uri-2.4.4-3.1.5-4.1.2/feed.json","home_page_url":"https://feed.craftedsignal.io/","items":[{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[{"cvss":7.5,"id":"CVE-2026-18446"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["fast-uri (2.4.4, 3.1.5, 4.1.2)"],"_cs_severities":["high"],"_cs_tags":[],"_cs_type":"advisory","_cs_vendors":[],"content_html":"\u003cp\u003eThe \u003ccode\u003efast-uri\u003c/code\u003e package (versions \u0026lt; 2.4.4, 3.0.0-3.1.5, and 4.0.0-4.1.2) is vulnerable to a URI parsing desync (CVE-2026-18446). While Node's native WHATWG \u003ccode\u003eURL\u003c/code\u003e parser treats backslashes as valid authority separators for special schemes like \u003ccode\u003ehttp\u003c/code\u003e and \u003ccode\u003ehttps\u003c/code\u003e, \u003ccode\u003efast-uri\u003c/code\u003e fails to recognize these non-standard authority introducers.\u003c/p\u003e\n\u003cp\u003eThis inconsistency allows an attacker to supply a URI reference containing backslashes (e.g., \u003ccode\u003e\\\\evil.com/path\u003c/code\u003e). \u003ccode\u003efast-uri\u003c/code\u003e treats the sequence as part of the path, causing security validation logic (like SSRF filters or allowlists) to perceive the request as targeting the trusted origin. Conversely, when the downstream \u003ccode\u003efetch()\u003c/code\u003e or \u003ccode\u003ehttp\u003c/code\u003e client consumes the same URI, it interprets the sequence as a cross-origin host, effectively bypassing the security controls. This vulnerability is critical for applications that rely on \u003ccode\u003efast-uri\u003c/code\u003e to perform host-based policy enforcement before passing requests to standard Node.js networking primitives.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows for the bypass of security controls including SSRF protection, loopback filtering, redirect validation, and outbound proxy routing. If an application uses \u003ccode\u003efast-uri\u003c/code\u003e to validate an input URL before passing it to \u003ccode\u003efetch()\u003c/code\u003e, an attacker can reach arbitrary external endpoints, potentially exfiltrating internal data, interacting with internal services, or bypassing egress restrictions.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate the \u003ccode\u003efast-uri\u003c/code\u003e dependency to versions 2.4.4, 3.1.5, or 4.1.2 immediately to receive the patch.\u003c/li\u003e\n\u003cli\u003eAudit applications using \u003ccode\u003efast-uri\u003c/code\u003e for security validation to ensure they do not perform security-critical decisions on URLs before passing them to native Node.js URL consumers.\u003c/li\u003e\n\u003cli\u003eImplement uniform URI parsing throughout the request lifecycle by preferring native Node.js URL APIs if strict \u003ccode\u003efast-uri\u003c/code\u003e compatibility is not required for performance reasons.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-08-03T20:48:20Z","date_published":"2026-08-03T20:48:20Z","id":"https://feed.craftedsignal.io/briefs/2026-08-fast-uri-host-confusion/","summary":"The fast-uri package exhibits a URI parsing discrepancy compared to the native Node.js WHATWG URL parser, allowing attackers to bypass host-based security policies through malicious backslash-encoded authorities.","title":"CVE-2026-18446 Host Confusion in fast-uri","url":"https://feed.craftedsignal.io/briefs/2026-08-fast-uri-host-confusion/"}],"language":"en","title":"CraftedSignal Threat Feed - Fast-Uri (2.4.4, 3.1.5, 4.1.2)","version":"https://jsonfeed.org/version/1.1"}