fast-uri vulnerable to host confusion via unchecked WHATWG host canonicalization

These records connect through source-stated identifiers. Shared identifiers or dates alone do not establish shared exposure, root cause or applicability.

CVE-2026-110180 · Microsoft / collected KEV context

GHSA-wjr9-j795-jxcr

cve-program · CVE-2026-110180

• https://github.com/fastify/fast-uri/security/advisories/GHSA-wjr9-j795-jxcr
• https://cna.openjsf.org/security-advisories.html

nvd · CVE-2026-110180

• https://cna.openjsf.org/security-advisories.html
• https://github.com/fastify/fast-uri/security/advisories/GHSA-wjr9-j795-jxcr

osv · GHSA-wjr9-j795-jxcr

• https://github.com/fastify/fast-uri/security/advisories/GHSA-wjr9-j795-jxcr
• https://nvd.nist.gov/vuln/detail/CVE-2026-110180
• https://github.com/fastify/fast-uri/commit/58c183d0b168ad87f98773266444ce1f6375803a
• https://github.com/fastify/fast-uri/commit/ddfc6a51122dfce0365655f04479fc3adb7f6b3c
• https://github.com/fastify/fast-uri/commit/f6d46dfeab025d0c440485f4ae29fa4f14707646
• https://cna.openjsf.org/security-advisories.html
• https://github.com/fastify/fast-uri
• https://github.com/fastify/fast-uri/releases/tag/v2.4.8
• https://github.com/fastify/fast-uri/releases/tag/v3.1.9
• https://github.com/fastify/fast-uri/releases/tag/v4.2.3

No related operational record is retained in the current change model.