Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-110180— fast-uri vulnerable to host confusion via unchecked WHATWG host canonicalization

Quick assessment

Affected
fast-uri fast-uri
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

fast-uri 是一个无依赖的 Node.js 库，用于解析和序列化符合 RFC 3986 标准的 URI。在 2.4.2 至 2.4.7、3.1.3 至 3.1.8 以及 4.0.1 至 4.2.2 版本中，针对 HTTP 系列协议， 函数将解析后的主机名传递给 WHATWG URL 解析器，并直接采用其返回的主机名，但未验证该解析器是否将整个输入内容完全解析为主机名。这导致权威部分（authority）可能被静默重写：@ 符号之前的数据会被丢弃，制表符、回车符和换行符会被移除，且不会报告任何错误。 若应用程序

CVSS 4.8 · Medium
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-110180

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
fast-uri vulnerable to host confusion via unchecked WHATWG host canonicalization
Source: CVE Program / CVE List V5
Vulnerability Description
fast-uri is a dependency-free RFC 3986 URI parser and serializer for Node.js. In versions from 2.4.2 through 2.4.7, from 3.1.3 through 3.1.8, and from 4.0.1 through 4.2.2, for HTTP-family schemes the canonicalizeHost() function passes the parsed host to the WHATWG URL parser and adopts its hostname without checking that the parser consumed the entire input as a host, so the authority can be silently rewritten: data before an at-sign is dropped and tab, carriage-return, and line-feed characters are stripped, with no error reported. An application that enforces host-based policy such as denylists, loopback filtering, redirect validation, or outbound proxy routing on one representation can then see the canonical host diverge from what it checked, allowing traffic to be steered to an unintended destination. The issue is fixed in fast-uri 2.4.8, 3.1.9, and 4.2.3, and users should upgrade to one of these versions or later. As a workaround, reject an authority that contains more than one at-sign or any tab, carriage-return, or line-feed before calling fast-uri, or treat any non-empty parse error as fatal and compare hosts only from the same parse result.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
输入验证不恰当
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
fast-uri fast-uri 2.4.2 ~ 2.4.8 -

II. Public POCs for CVE-2026-110180

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-110180

请登录查看更多情报信息。

Vendor Advisories for CVE-2026-110180 (1)

Same Patch Batch · fast-uri · 2026-10-20 · 4 CVEs total

CVE-2026-110306 6.1 MEDIUM fast-uri vulnerable to URI scheme spoofing via percent-encoded scheme decoding
CVE-2026-110095 3.7 LOW fast-uri vulnerable to improper path equivalence in relative reference normalization
CVE-2026-110725 3.7 LOW fast-uri vulnerable to scheme injection via an unescaped first-segment colon in suffix ref

IV. Related Vulnerabilities

Same product: fast-uri
Same vendor: fast-uri
Same weakness: CWE-20

V. Comments for CVE-2026-110180

No comments yet

Leave a comment