{"id":"CVE-2026-110180","revision":null,"records":[{"revision":"6da9577a003b428596b358fbd15dfb8f","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2026-110180","aliases":[],"title":"fast-uri vulnerable to host confusion via unchecked WHATWG host canonicalization","description":"fast-uri is a dependency-free RFC 3986 URI parser and serializer for Node.js. In versions from 2.4.2 through 2.4.7, from 3.1.3 through 3.1.8, and from 4.0.1 through 4.2.2, for HTTP-family schemes the canonicalizeHost() function passes the parsed host to the WHATWG URL parser and adopts its hostname without checking that the parser consumed the entire input as a host, so the authority can be silently rewritten: data before an at-sign is dropped and tab, carriage-return, and line-feed characters are stripped, with no error reported. An application that enforces host-based policy such as denylists, loopback filtering, redirect validation, or outbound proxy routing on one representation can then see the canonical host diverge from what it checked, allowing traffic to be steered to an unintended destination. The issue is fixed in fast-uri 2.4.8, 3.1.9, and 4.2.3, and users should upgrade to one of these versions or later. As a workaround, reject an authority that contains more than one at-sign or any tab, carriage-return, or line-feed before calling fast-uri, or treat any non-empty parse error as fatal and compare hosts only from the same parse result.","state":0,"publishedAt":"2026-10-20T07:00:42.153+00:00","modifiedAt":"2026-10-20T16:06:48.503+00:00","affected":[{"ecosystem":"Vendor product","name":"fast-uri","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"fast-uri\",\n                    \"product\": \"fast-uri\",\n                    \"defaultStatus\": \"unaffected\",\n                    \"versions\": [\n                        {\n                            \"versionType\": \"semver\",\n                            \"status\": \"affected\",\n                            \"version\": \"2.4.2\",\n                            \"lessThan\": \"2.4.8\"\n                        },\n                        {\n                            \"versionType\": \"semver\",\n                            \"status\": \"unaffected\",\n                            \"version\": \"2.4.8\"\n                        },\n                        {\n                            \"versionType\": \"semver\",\n                            \"status\": \"affected\",\n                            \"version\": \"3.1.3\",\n                            \"lessThan\": \"3.1.9\"\n                        },\n                        {\n                            \"versionType\": \"semver\",\n                            \"status\": \"unaffected\",\n                            \"version\": \"3.1.9\"\n                        },\n                        {\n                            \"versionType\": \"semver\",\n                            \"status\": \"affected\",\n                            \"version\": \"4.0.1\",\n                            \"lessThan\": \"4.2.3\"\n                        },\n                        {\n                            \"versionType\": \"semver\",\n                            \"status\": \"unaffected\",\n                            \"version\": \"4.2.3\"\n                        }\n                    ],\n                    \"packageURL\": \"pkg:npm/fast-uri\"\n                }"}],"metrics":[{"system":"CVSS 3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N","score":4.8,"severity":"MEDIUM"}],"references":["https://github.com/fastify/fast-uri/security/advisories/GHSA-wjr9-j795-jxcr","https://cna.openjsf.org/security-advisories.html"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-110180","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-110180","identifiers":["CVE-2026-110180"]},"retained":false,"historicalAffected":[]},{"revision":"9da2d4446a834acebc05d339c5fa49cb","observedAt":"2026-10-25T05:17:13.11+00:00","statement":{"source":"nvd","id":"CVE-2026-110180","aliases":[],"title":"fast-uri is a dependency-free RFC 3986 URI parser and serializer for Node.js. In versions from 2.4.2 through 2.4.7, from 3.1.3 through 3.1.8, and from 4.0.1 through 4.2.2, for HTTP-family schemes the canonicalizeHost() function passes the p…","description":"fast-uri is a dependency-free RFC 3986 URI parser and serializer for Node.js. In versions from 2.4.2 through 2.4.7, from 3.1.3 through 3.1.8, and from 4.0.1 through 4.2.2, for HTTP-family schemes the canonicalizeHost() function passes the parsed host to the WHATWG URL parser and adopts its hostname without checking that the parser consumed the entire input as a host, so the authority can be silently rewritten: data before an at-sign is dropped and tab, carriage-return, and line-feed characters are stripped, with no error reported. An application that enforces host-based policy such as denylists, loopback filtering, redirect validation, or outbound proxy routing on one representation can then see the canonical host diverge from what it checked, allowing traffic to be steered to an unintended destination. The issue is fixed in fast-uri 2.4.8, 3.1.9, and 4.2.3, and users should upgrade to one of these versions or later. As a workaround, reject an authority that contains more than one at-sign or any tab, carriage-return, or line-feed before calling fast-uri, or treat any non-empty parse error as fatal and compare hosts only from the same parse result.","state":0,"publishedAt":"2026-10-20T07:17:08.687+00:00","modifiedAt":"2026-10-20T20:06:37.15+00:00","affected":[],"metrics":[{"system":"CVSS 3.1 · ce714d77-add3-4f53-aff5-83d477b104bb · Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N","score":4.8,"severity":"MEDIUM"}],"references":["https://cna.openjsf.org/security-advisories.html","https://github.com/fastify/fast-uri/security/advisories/GHSA-wjr9-j795-jxcr"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-110180","license":"NIST NVD usage terms; underlying source attribution retained","enrichment":{"sourceStatus":"Awaiting Analysis","weaknesses":["CWE-20","CWE-436"],"productCriteria":[],"sourceDates":{"published":"2026-10-20T07:17:08.687","lastModified":"2026-10-20T20:06:37.150"},"relatedAdvisories":[],"note":"NVD analysis and CPE criteria are source context, not proof that a package or your environment is affected. Complete affected data, logical configurations and SSVC are retained in the original JSON."},"key":"nvd:CVE-2026-110180","identifiers":["CVE-2026-110180"]},"retained":false,"historicalAffected":[]},{"revision":"11f81a8267b740beb7fe02dcec40670d","observedAt":"2026-10-24T13:17:17.793+00:00","statement":{"source":"osv","id":"GHSA-wjr9-j795-jxcr","aliases":["CVE-2026-110180"],"title":"fast-uri vulnerable to host confusion via unchecked WHATWG host canonicalization","description":"### Impact\n\n`fast-uri` versions `>= 2.4.2, <= 2.4.7`, `>= 3.1.3, <= 3.1.8`, and `>= 4.0.1, <= 4.2.2` can silently rewrite the host of an HTTP-family URL (`http`, `https`, `ws`, `wss`, or any scheme with `domainHost: true`). For those schemes `canonicalizeHost()` passes the parsed host to the WHATWG `URL` parser and adopts its `.hostname` without checking that the parser read the whole input as a host. RFC 3986 permits `@` inside the host group and the WHATWG parser strips TAB, LF, and CR, so the authority `fast-uri` reports is rewritten by that second parser with no `error` set: data before an `@` is dropped and whitespace is removed.\n\nFor example, `fast-uri` parses `http://a@b@evil.example/` to host `evil.example` (dropping the `b` segment), and a host containing a raw TAB, CR, or LF has those characters stripped. `equal()` then treats a whitespace-smuggled host as the same as the clean one, and `resolve()` rewrites the authority the same way.\n\nApplications that use `fast-uri` to enforce host-based policy (denylists, loopback filtering, redirect validation, outbound proxy routing) on one representation, such as the raw input, see a policy/use desync: the canonical host `fast-uri` returns differs from what was checked, and traffic can be steered to an unintended destination.\n\n### Patches\n\nUpgrade to `fast-uri` `2.4.8`, `3.1.9`, or `4.2.3`.\n\n### Workarounds\n\nReject URIs whose authority contains more than one `@`, or contains TAB, CR, or LF, before calling `fast-uri`. Alternatively, treat any non-empty `parse(x).error` as fatal, and compare hosts only from the same `parse()` result.","state":0,"publishedAt":"2026-10-23T21:37:59+00:00","modifiedAt":"2026-10-23T21:45:04.8920547+00:00","affected":[{"ecosystem":"npm","name":"fast-uri","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"2.4.2"},{"kind":"fixed","version":"2.4.8"}]}],"versions":[],"rawVersionEvidence":null},{"ecosystem":"npm","name":"fast-uri","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"3.1.3"},{"kind":"fixed","version":"3.1.9"}]}],"versions":[],"rawVersionEvidence":null},{"ecosystem":"npm","name":"fast-uri","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"4.0.1"},{"kind":"fixed","version":"4.2.3"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[{"system":"CVSS_V3","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N","score":null,"severity":null},{"system":"Publisher rating","vector":null,"score":null,"severity":"MODERATE"}],"references":["https://github.com/fastify/fast-uri/security/advisories/GHSA-wjr9-j795-jxcr","https://nvd.nist.gov/vuln/detail/CVE-2026-110180","https://github.com/fastify/fast-uri/commit/58c183d0b168ad87f98773266444ce1f6375803a","https://github.com/fastify/fast-uri/commit/ddfc6a51122dfce0365655f04479fc3adb7f6b3c","https://github.com/fastify/fast-uri/commit/f6d46dfeab025d0c440485f4ae29fa4f14707646","https://cna.openjsf.org/security-advisories.html","https://github.com/fastify/fast-uri","https://github.com/fastify/fast-uri/releases/tag/v2.4.8","https://github.com/fastify/fast-uri/releases/tag/v3.1.9","https://github.com/fastify/fast-uri/releases/tag/v4.2.3"],"sourceUrl":"https://github.com/advisories/GHSA-wjr9-j795-jxcr","license":"GitHub Advisory Database · CC-BY-4.0","key":"osv:GHSA-wjr9-j795-jxcr","identifiers":["GHSA-wjr9-j795-jxcr","CVE-2026-110180"]},"retained":false,"historicalAffected":[]}],"coverage":[{"source":"cisa-kev:global","scope":"Complete CISA KEV catalog; all vendors. Missing entries do not establish absence of exploitation.","generation":"2026-10-26T15:37:14.6597162+00:00","complete":true,"records":1756,"lastAttemptAt":"2026-10-26T15:37:14.6597162+00:00","lastSuccessAt":"2026-10-26T15:37:14.8359072+00:00","error":null,"lastVerifiedAt":"2026-10-26T15:37:14.835909+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null},{"source":"cve-program","scope":"Official CVE Program baseline and cumulative hourly delta; all vendors, published and rejected records","generation":"cve-5ba1945314e042c2ced14b33f3680fa71692812d925544312b218f5eb8a26e71-1bd091fc7fc10547d7167a606edbc49905944b97501a7ab971c3b58807479a43","complete":true,"records":414270,"lastAttemptAt":"2026-10-26T15:35:34.7444644+00:00","lastSuccessAt":"2026-10-26T15:35:34.5655912+00:00","error":null,"lastVerifiedAt":"2026-10-26T15:35:34.7444644+00:00","snapshotPublishedAt":"2026-10-26T15:15:44+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null},{"source":"euvd","scope":"Rolling EUVD lookups of CVE aliases in current public OSV archives; 500 identifiers per refresh, rechecked after 48 hours. Not a global EUVD catalog. Successful not-found lookups count as checked; they do not imply withdrawal or safety. No reader inventory is sent.","generation":"enrichment-43321610382942b8ad8c85917eab1546","complete":false,"records":4735,"lastAttemptAt":"2026-10-26T15:37:42.3202578+00:00","lastSuccessAt":"2026-10-24T23:18:49.862+00:00","error":"InvalidDataException","lastVerifiedAt":"2026-10-24T23:18:49.862+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":3564,"expectedIdentifiers":13477},{"source":"first-epss:nuget","scope":"FIRST EPSS for explicit CVE aliases in the collected public NuGet archive. Not a global EPSS backfill.","generation":"2026-10-26T15:37:14.6597162+00:00","complete":true,"records":1093,"lastAttemptAt":"2026-10-26T15:37:14.6597162+00:00","lastSuccessAt":"2026-10-26T15:37:14.8367292+00:00","error":null,"lastVerifiedAt":"2026-10-26T15:37:14.8367325+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null},{"source":"nvd","scope":"Rolling NVD lookups of CVE aliases in current public OSV archives; 500 identifiers per refresh, rechecked after 48 hours. Not a global NVD catalog. Successful not-found lookups count as checked; they do not imply withdrawal or safety. No reader inventory is sent.","generation":"enrichment-f470a37230314a1cb4fdd0380273a29f","complete":true,"records":13416,"lastAttemptAt":"2026-10-26T15:37:40.3021752+00:00","lastSuccessAt":"2026-10-26T15:37:40.298+00:00","error":null,"lastVerifiedAt":"2026-10-26T15:37:40.298+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":13477,"expectedIdentifiers":13477},{"source":"osv:Go","scope":"Complete OSV Go ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"go-c3121b113ecd88f1c92ccfa0ec9757ddc8386e4c12afd2597450b815744f800a","complete":true,"records":9779,"lastAttemptAt":"2026-10-26T15:37:14.5249967+00:00","lastSuccessAt":"2026-10-26T15:37:14.3083004+00:00","error":null,"lastVerifiedAt":"2026-10-26T15:37:14.5249967+00:00","snapshotPublishedAt":"2026-10-26T14:48:41+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null},{"source":"osv:NuGet","scope":"Complete OSV NuGet ecosystem archive, including GitHub Advisory Database records; NuGet version matching only","generation":"nuget-16ad89dfea13ab9e9b0108e63a759d63bd4559cc68b58491107d62ee35bbbaf2","complete":true,"records":1965,"lastAttemptAt":"2026-10-26T15:35:34.8406753+00:00","lastSuccessAt":"2026-10-23T16:01:26.4487605+00:00","error":null,"lastVerifiedAt":"2026-10-26T15:35:34.8406753+00:00","snapshotPublishedAt":"2026-10-21T12:18:07+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null},{"source":"osv:crates.io","scope":"Complete OSV crates.io ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"crates.io-a393d8fe0ae8408f3e4cab413b76047090c8e4a3c0a186c79edf33c9a3d3af95","complete":true,"records":2995,"lastAttemptAt":"2026-10-26T15:37:14.6306288+00:00","lastSuccessAt":"2026-10-26T14:35:47.9640893+00:00","error":null,"lastVerifiedAt":"2026-10-26T15:37:14.6306288+00:00","snapshotPublishedAt":"2026-10-26T14:18:55+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null},{"source":"osv:npm","scope":"Complete OSV npm ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"npm-e462c1c8904fe18fc1ab10d13d0abcd333d928efa63a77a5731657497361d59c","complete":true,"records":230805,"lastAttemptAt":"2026-10-26T15:37:06.3736048+00:00","lastSuccessAt":"2026-10-26T15:37:05.2219961+00:00","error":null,"lastVerifiedAt":"2026-10-26T15:37:06.3736048+00:00","snapshotPublishedAt":"2026-10-26T14:48:44+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null}]}