URI Parsing Vulnerability in fast-uri for Node.js

CVE-2026-110180

What is CVE-2026-110180?

The fast-uri library versions 2.4.2 to 4.2.2 for Node.js exhibits a vulnerability in the canonicalizeHost() function. This function fails to ensure that the entire input is consumed as a host, leading to potential traffic redirection. Specifically, it strips certain control characters and drops data before the at-sign without reporting any errors. This can create inconsistencies in host checks, undermining security features like deny lists and redirect validation. It is crucial for users to upgrade to fast-uri versions 2.4.8, 3.1.9, or 4.2.3 to mitigate this risk.

References