{"id":"CVE-2026-18446","title":"fast-uri: fast-uri: Host confusion vulnerability via backslash in URI authority (CVE-2026-18446)","summary":"A flaw was found in fast-uri. This vulnerability arises because fast-uri incorrectly parses Uniform Resource Identifiers (URIs) when a backslash is used in place of a forward slash to introduce the authority component. This discrepancy wit…","severity":"high","cvss":7.5,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","cvssSource":"vendor","cwe":["CWE-1289","CWE-436"],"vendor":"Red Hat","product":"Red Hat OpenShift AI 3.4","affected":["migration_toolkit_for_applications 8","openshift_serverless","build_of_apache_camel_hawtio 4","build_of_apicurio_registry 3","build_of_podman_desktop","connectivity_link 1","directory_server 11","directory_server 12","edge_manager 1","enterprise_linux 10","enterprise_linux 8","enterprise_linux 9","enterprise_linux_ai_rhel_ai 3","openshift_ai_rhoai","openshift_container_platform 4","openshift_data_foundation 4","openshift_dev_spaces","satellite 6","hardened_images","openshift_ai 2.25","openshift_ai 3.4","openshift_container_platform 4.16","openshift_container_platform 4.21","openshift_container_platform 4.22"],"patched":["hardened_images","openshift_ai 2.25","openshift_ai 3.4","openshift_container_platform 4.16","openshift_container_platform 4.21","openshift_container_platform 4.22"],"published":"2026-07-31","updated":"2026-10-23","sourceUpdated":"2026-10-23T21:27:22+00:00","source":"CSAF","sourceUrl":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-18446.json","references":[{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-18446.json"},{"url":"https://access.redhat.com/security/cve/CVE-2026-18446"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2509801"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-18446"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-18446"},{"url":"https://cna.openjsf.org/security-advisories.html"},{"url":"https://github.com/fastify/fast-uri/security/advisories/GHSA-7p8r-x3mc-p8w7"},{"url":"https://access.redhat.com/errata/RHSA-2026:49401"},{"url":"https://access.redhat.com/errata/RHSA-2026:49387"},{"url":"https://access.redhat.com/errata/RHSA-2026:87410"},{"url":"https://access.redhat.com/errata/RHSA-2026:84734"},{"url":"https://access.redhat.com/errata/RHSA-2026:62550"},{"url":"https://access.redhat.com/errata/RHSA-2026:68547"},{"url":"https://access.redhat.com/errata/RHSA-2026:68553"},{"url":"https://access.redhat.com/errata/RHSA-2026:71454"},{"url":"https://github.com/fastify/fast-uri/commit/f3c6c905f47831007490f466c5945012e905cc52"},{"url":"https://github.com/fastify/fast-uri/releases/tag/v4.1.2"},{"url":"https://github.com/advisories/GHSA-7p8r-x3mc-p8w7"}],"tags":["csaf","vex","red-hat","ghsa","npm"],"epss":0.0038,"epssPercentile":0.31806,"aliases":["GHSA-7p8r-x3mc-p8w7"],"ecosystem":"npm","ingestedAt":"2026-08-03T19:29:00.364Z","slug":"CVE-2026-18446","body":"## Overview\n\nA flaw was found in fast-uri. This vulnerability arises because fast-uri incorrectly parses Uniform Resource Identifiers (URIs) when a backslash is used in place of a forward slash to introduce the authority component. This discrepancy with Node's native WHATWG URL parser can lead to host confusion. A remote attacker could exploit this to bypass security policies, such as allowlists or Server-Side Request Forgery (SSRF) filters, potentially redirecting applications to unintended hosts.\n\n## Vendor advisories\n\n- **RHSA-2026:49401** · Red Hat · fixed in: Red Hat Hardened Images · released 2026-08-01 · [advisory](https://access.redhat.com/errata/RHSA-2026:49401)\n- **RHSA-2026:49387** · Red Hat · fixed in: Red Hat Hardened Images · released 2026-08-01 · [advisory](https://access.redhat.com/errata/RHSA-2026:49387)\n- **RHSA-2026:87410** · Red Hat · fixed in: Red Hat OpenShift AI 2.25 · released 2026-10-21 · [advisory](https://access.redhat.com/errata/RHSA-2026:87410)\n- **RHSA-2026:84734** · Red Hat · fixed in: Red Hat OpenShift AI 3.4 · released 2026-10-19 · [advisory](https://access.redhat.com/errata/RHSA-2026:84734)\n- **RHSA-2026:62550** · Red Hat · fixed in: Red Hat OpenShift Container Platform 4.16 · released 2026-09-10 · [advisory](https://access.redhat.com/errata/RHSA-2026:62550)\n- **RHSA-2026:68547** · Red Hat · fixed in: Red Hat OpenShift Container Platform 4.21 · released 2026-09-22 · [advisory](https://access.redhat.com/errata/RHSA-2026:68547)\n- **RHSA-2026:68553** · Red Hat · fixed in: Red Hat OpenShift Container Platform 4.22 · released 2026-09-22 · [advisory](https://access.redhat.com/errata/RHSA-2026:68553)\n- **RHSA-2026:71454** · Red Hat · fixed in: Red Hat OpenShift Container Platform 4.22 · released 2026-09-29 · [advisory](https://access.redhat.com/errata/RHSA-2026:71454)\n- **Red Hat VEX** · Important · affected: Migration Toolkit for Applications 8, OpenShift Serverless, Red Hat build of Apache Camel - HawtIO 4, Red Hat build of Apicurio Registry 3, Red Hat Build of Podman Desktop, Red Hat Connectivity Link 1, … · no fix planned: Red Hat Edge Manager 1, Red Hat Enterprise Linux AI (RHEL AI) 3, Migration Toolkit for Applications 8, OpenShift Serverless, … · updated 2026-10-23 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-18446.json)\n\n**fast-uri: fast-uri: Host confusion vulnerability via backslash in URI authority** — rated Important by Red Hat. Released 2026-07-31, updated 2026-10-23.\n\nAffected:\n\n- Migration Toolkit for Applications 8\n- OpenShift Serverless\n- Red Hat build of Apache Camel - HawtIO 4\n- Red Hat build of Apicurio Registry 3\n- Red Hat Build of Podman Desktop\n- Red Hat Connectivity Link 1\n- Red Hat Directory Server 11\n- Red Hat Directory Server 12\n- Red Hat Edge Manager 1\n- Red Hat Enterprise Linux 10\n- Red Hat Enterprise Linux 8\n- Red Hat Enterprise Linux 9\n- Red Hat Enterprise Linux AI (RHEL AI) 3\n- Red Hat OpenShift AI (RHOAI)\n- Red Hat OpenShift Container Platform 4\n- Red Hat Openshift Data Foundation 4\n- Red Hat OpenShift Dev Spaces\n- Red Hat Satellite 6\n\nFixed:\n\n- Red Hat Hardened Images\n- Red Hat OpenShift AI 2.25\n- Red Hat OpenShift AI 3.4\n- Red Hat OpenShift Container Platform 4.16\n- Red Hat OpenShift Container Platform 4.21\n- Red Hat OpenShift Container Platform 4.22\n\nNo fix planned:\n\n- Red Hat Edge Manager 1\n- Red Hat Enterprise Linux AI (RHEL AI) 3\n- Migration Toolkit for Applications 8\n- OpenShift Serverless\n- Red Hat build of Apache Camel - HawtIO 4\n- Red Hat build of Apicurio Registry 3\n- Red Hat Build of Podman Desktop\n- Red Hat Connectivity Link 1\n- Red Hat Directory Server 11\n- Red Hat Directory Server 12\n- Red Hat Enterprise Linux 10\n- Red Hat Enterprise Linux 8\n- Red Hat Enterprise Linux 9\n- Red Hat OpenShift AI (RHOAI)\n- Red Hat OpenShift Container Platform 4\n- Red Hat Openshift Data Foundation 4\n- Red Hat OpenShift Dev Spaces\n- Red Hat Satellite 6\n\nNot affected:\n\n- Red Hat OpenShift AI 2.25\n- Red Hat OpenShift AI 3.4\n- Red Hat OpenShift Container Platform 4.16\n- Red Hat OpenShift Container Platform 4.21\n- Red Hat OpenShift Container Platform 4.22\n- Cost Management On Premise\n- Cryostat 4\n- Migration Toolkit for Containers\n- Multicluster Engine for Kubernetes\n- Network Observability Operator\n\n## Remediation\n\nFor details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/ https://access.redhat.com/errata/RHSA-2026:49401\nFor details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/ https://access.redhat.com/errata/RHSA-2026:49387\nFor Red Hat OpenShift AI 2.25.12 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this errata update:\n\nhttps://docs.redhat.com/en/documentation/red_hat_openshift_ai/ https://access.redhat.com/errata/RHSA-2026:87410\n\nWorkarounds / mitigations:\n\n- Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.\n\n## Package advisory (CVE-2026-18446)\n\nAffected packages:\n\n- `fast-uri < 2.4.4`\n- `fast-uri >= 3.0.0, < 3.1.5`\n- `fast-uri >= 4.0.0, < 4.1.2`\n\nPatched in:\n\n- `fast-uri 2.4.4`\n- `fast-uri 3.1.5`\n- `fast-uri 4.1.2`\n\nSource: https://github.com/advisories/GHSA-7p8r-x3mc-p8w7","depth":"twilight","depthScore":41,"depthScoreParts":{"impact":41.3,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}