{"id":"CVE-2026-110180","aliases":["GHSA-wjr9-j795-jxcr"],"title":"fast-uri vulnerable to host confusion via unchecked WHATWG host canonicalization","summary":"fast-uri vulnerable to host confusion via unchecked WHATWG host canonicalization","severity":"medium","cvss":4.8,"cwe":["CWE-20","CWE-436","CWE-1286"],"vendor":"fast-uri","product":"fast-uri","ecosystem":"npm","affected":["fast-uri >= 2.4.2, < 2.4.8","fast-uri >= 3.1.3, < 3.1.9","fast-uri >= 4.0.1, < 4.2.3"],"patched":["fast-uri 2.4.8","fast-uri 3.1.9","fast-uri 4.2.3"],"published":"2026-10-23","updated":"2026-10-23","sourceUpdated":"2026-10-23T21:38:02Z","source":"GHSA","sourceUrl":"https://github.com/advisories/GHSA-wjr9-j795-jxcr","references":[{"url":"https://github.com/fastify/fast-uri/security/advisories/GHSA-wjr9-j795-jxcr"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-110180"},{"url":"https://github.com/fastify/fast-uri/commit/58c183d0b168ad87f98773266444ce1f6375803a"},{"url":"https://github.com/fastify/fast-uri/commit/ddfc6a51122dfce0365655f04479fc3adb7f6b3c"},{"url":"https://github.com/fastify/fast-uri/commit/f6d46dfeab025d0c440485f4ae29fa4f14707646"},{"url":"https://cna.openjsf.org/security-advisories.html"},{"url":"https://github.com/fastify/fast-uri/releases/tag/v2.4.8"},{"url":"https://github.com/fastify/fast-uri/releases/tag/v3.1.9"},{"url":"https://github.com/fastify/fast-uri/releases/tag/v4.2.3"},{"url":"https://github.com/advisories/GHSA-wjr9-j795-jxcr"},{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-110180.json"},{"url":"https://access.redhat.com/security/cve/CVE-2026-110180"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2556008"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-110180"}],"tags":["ghsa","npm","cve.org","csaf","vex","red-hat"],"epss":0.00255,"epssPercentile":0.16981,"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"partial","timestamp":"2026-10-20T16:06:29.053757Z"},"ingestedAt":"2026-10-20T07:55:43.639Z","slug":"CVE-2026-110180","body":"## Overview\n\n### Impact\n\n`fast-uri` versions `>= 2.4.2, <= 2.4.7`, `>= 3.1.3, <= 3.1.8`, and `>= 4.0.1, <= 4.2.2` can silently rewrite the host of an HTTP-family URL (`http`, `https`, `ws`, `wss`, or any scheme with `domainHost: true`). For those schemes `canonicalizeHost()` passes the parsed host to the WHATWG `URL` parser and adopts its `.hostname` without checking that the parser read the whole input as a host. RFC 3986 permits `@` inside the host group and the WHATWG parser strips TAB, LF, and CR, so the authority `fast-uri` reports is rewritten by that second parser with no `error` set: data before an `@` is dropped and whitespace is removed.\n\nFor example, `fast-uri` parses `http://a@b@evil.example/` to host `evil.example` (dropping the `b` segment), and a host containing a raw TAB, CR, or LF has those characters stripped. `equal()` then treats a whitespace-smuggled host as the same as the clean one, and `resolve()` rewrites the authority the same way.\n\nApplications that use `fast-uri` to enforce host-based policy (denylists, loopback filtering, redirect validation, outbound proxy routing) on one representation, such as the raw input, see a policy/use desync: the canonical host `fast-uri` returns differs from what was checked, and traffic can be steered to an unintended destination.\n\n### Patches\n\nUpgrade to `fast-uri` `2.4.8`, `3.1.9`, or `4.2.3`.\n\n### Workarounds\n\nReject URIs whose authority contains more than one `@`, or contains TAB, CR, or LF, before calling `fast-uri`. Alternatively, treat any non-empty `parse(x).error` as fatal, and compare hosts only from the same `parse()` result.\n\n## Affected packages\n\n- `fast-uri >= 2.4.2, < 2.4.8`\n- `fast-uri >= 3.1.3, < 3.1.9`\n- `fast-uri >= 4.0.1, < 4.2.3`\n\n## Remediation\n\nUpgrade to a patched release:\n\n- `fast-uri 2.4.8`\n- `fast-uri 3.1.9`\n- `fast-uri 4.2.3`\n\n## Vendor advisories\n\n- **Red Hat VEX** · Moderate · affected: Cost Management On Premise, Cryostat 4, Migration Toolkit for Applications 8, Multicluster Engine for Kubernetes, Network Observability Operator, OpenShift Lightspeed, … · no fix planned: Red Hat Ansible Automation Platform 2, Red Hat Directory Server 11, Red Hat Directory Server 12, Red Hat Openshift Data Foundation 4, … · updated 2026-10-20 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-110180.json)","depth":"sunlit","depthScore":26,"depthScoreParts":{"impact":26.4,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}