fast-uri vulnerable to host confusion via unchecked WHATWG host canonicalization
CVE-2026-110180
Impact fast-uri versions >= 2.4.2, = 3.1.3, = 4.0.1, <= 4.2.2 can silently rewrite the host of an HTTP-family URL (http, https, ws, wss, or any scheme with domainHost: true). For those schemes canonicalizeHost() passes the parsed host to the WHATWG URL parser and adopts its .hostname without checking that the parser read the whole input as a host. RFC 3986 permits @ inside the host group and the WHATWG parser strips TAB, LF, and CR, so the authority fast-uri reports is rewritten by that second parser with no error set: data before an @ is dropped and whitespace is removed. For example, fast-uri parses http://a@b@evil.example/ to host evil.example (dropping the b segment), and a host containing a raw TAB, CR, or LF has those characters stripped. equal() then treats a whitespace-smuggled host as the same as the clean one, and resolve() rewrites the authority the same way. Applications that use fast-uri to enforce host-based policy (denylists, loopback filtering, redirect validation, outbound proxy routing) on one representation, such as the raw input, see a policy/use desync: the canonical host fast-uri returns differs from what was checked, and traffic can be steered to an…
Assessment
- CVSS
- 4.8 (v3.1)
- Severity
- Medium
- EPSS
- 0.00255% chance of exploitation in the next 30 days
- Known exploited
- Not listed in CISA KEV
- Exploit availability
- Nothing found in Exploit-DB, Metasploit, Nuclei or public PoC repositories
- Published
- 23 October 2026
- Last updated
- 23 October 2026
- Affected
- npm · fast-uri
- Weakness
- CWE-20, CWE-436
CVSS vectorCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N
At the source
References
- https://github.com/fastify/fast-uri/security/advisories/GHSA-wjr9-j795-jxcr
- https://nvd.nist.gov/vuln/detail/CVE-2026-110180
- https://github.com/fastify/fast-uri/commit/58c183d0b168ad87f98773266444ce1f6375803a
- https://github.com/fastify/fast-uri/commit/ddfc6a51122dfce0365655f04479fc3adb7f6b3c
- https://github.com/fastify/fast-uri/commit/f6d46dfeab025d0c440485f4ae29fa4f14707646
- https://cna.openjsf.org/security-advisories.html
- https://github.com/fastify/fast-uri/releases/tag/v2.4.8
- https://github.com/fastify/fast-uri/releases/tag/v3.1.9
- https://github.com/fastify/fast-uri/releases/tag/v4.2.3
- https://github.com/advisories/GHSA-wjr9-j795-jxcr
Community proofs of concept
No community proof of concept yet. If you have one for a published vulnerability and the right to share it, add it below — it will appear here once reviewed.
Submit a proof of concept
Only for publicly disclosed vulnerabilities, and only material from testing you were authorised to perform. This platform does not buy, sell, or broker exploits — see earning from vulnerability research for legitimate bounty programs. Submissions are reviewed before they appear. Text only; do not include live credentials, personal data, or anything targeting systems you are not permitted to test.
Query this programmatically
Agents can read this through the MCP endpoint, or over HTTP:
curl https://cve.zerocrew.in/api/cve/CVE-2026-110180