URI Parsing Vulnerability in Fast-uri Library by Fastify
CVE-2026-18446

7.5HIGH

Key Information:

Vendor

Fast-uri

Status
Fast-uri
Vendor
CVE Published:
31 July 2026

What is CVE-2026-18446?

The fast-uri library versions before 4.1.2, 3.1.5, and 2.4.4 improperly handle URI authority, requiring a specific literal double forward slash. When alternative backslash-based introducers are used, the parser fails to recognize the authority, leading to unintended path folding. This discrepancy allows applications utilizing fast-uri for host-based policies, such as allowlists and SSRF filtering, to inadvertently direct traffic to unintended hosts, potentially compromising application integrity. It is recommended to upgrade to the latest versions of fast-uri to mitigate these risks.

Affected Version(s)

fast-uri 4.0.0 < 4.1.2

fast-uri 3.0.0 < 3.1.5

fast-uri 0 < 2.4.4

References

https://github.com/fastify/fast-uri/security/advisories/G...
https://cna.openjsf.org/security-advisories.html

CVSS V3.1

Score:
7.5
Severity:
HIGH
Confidentiality:
None
Integrity:
High
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

alanturing881
mcollina
UlisesGascon
.