CVE-2026-18446: fast-uri SSRF Vulnerability

CVE-2026-18446 Overview

CVE-2026-18446 is a URL parser confusion vulnerability [CWE-436] in the fast-uri Node.js library. Versions before 4.1.2, 3.1.5, and 2.4.4 require a literal double forward slash (//) to recognize a URI authority component. References using backslash-based introducers such as \\, /\, or \/ are parsed with no authority and fold into the path. Node's native WHATWG URL parser treats backslashes as interchangeable with forward slashes for special schemes. The two parsers extract different hosts from the same input, allowing attackers to bypass host-based security controls.

Critical Impact
Applications using fast-uri for allowlist enforcement, Server-Side Request Forgery (SSRF) filtering, or redirect validation can be steered to unintended hosts when the same URL is later consumed by Node's URL or fetch APIs.

Affected Products

fast-uri versions prior to 2.4.4 (2.x branch)
fast-uri versions prior to 3.1.5 (3.x branch)
fast-uri versions prior to 4.1.2 (4.x branch)

Discovery Timeline

2026-07-31 - CVE-2026-18446 published to NVD
2026-07-31 - Last updated in NVD database

Technical Details for CVE-2026-18446

Vulnerability Analysis

The vulnerability is a parser differential [CWE-436] between fast-uri and the Node.js WHATWG URL implementation. When two parsers interpret the same input differently, security decisions made by one component fail to constrain the behavior of another. In this case, fast-uri follows a strict interpretation of RFC 3986, requiring the exact // sequence to introduce an authority. Node's native URL parser follows the WHATWG URL specification, which normalizes backslashes to forward slashes for special schemes such as http and https.

An attacker crafts a URL where fast-uri reports one host (or no host at all) while Node's parser resolves a different, attacker-controlled host. Security middleware that validates the URL with fast-uri accepts the request, then hands the raw string to fetch or URL, which connects to the attacker's target.

Root Cause

The root cause is inconsistent authority-component recognition between two URL parsers operating on the same input string. fast-uri treats \\example.com, /\example.com, and \/example.com as path segments with no authority. Node's WHATWG parser treats these as equivalent to //example.com and extracts example.com as the host.

Attack Vector

Exploitation requires no authentication and occurs over the network. An attacker submits a URL such as http:/\attacker.example/path to an application endpoint that validates redirects, callback URLs, or outbound request targets. The fast-uri check sees no authority and accepts the input as an internal path. The downstream fetch call resolves the host to attacker.example and issues the request, enabling SSRF, open redirect, or allowlist bypass depending on the consumer.

No verified public proof-of-concept code is available. See the GitHub Security Advisory GHSA-7p8r-x3mc-p8w7 for technical details from the maintainers.

Detection Methods for CVE-2026-18446

Indicators of Compromise

Outbound HTTP requests to unexpected external hosts originating from Node.js services that perform URL validation
Application logs showing accepted URLs containing backslash characters (\) in the scheme-to-authority transition
Redirect responses (3xx) to attacker-controlled domains following user-supplied URL parameters

Detection Strategies

Inventory Node.js dependencies with npm ls fast-uri to identify vulnerable versions across projects and transitive dependencies such as fastify and ajv-formats
Add Web Application Firewall (WAF) rules that flag URL parameters containing \ characters in scheme or authority positions
Compare parsed host values between fast-uri and Node's URL at validation boundaries and alert on divergence

Monitoring Recommendations

Log the resolved host of every outbound fetch call in services that accept user-controlled URLs
Monitor Software Composition Analysis (SCA) findings for fast-uri versions below 2.4.4, 3.1.5, or 4.1.2
Alert on SSRF indicators such as requests to internal IP ranges, cloud metadata endpoints (169.254.169.254), or newly registered domains

How to Mitigate CVE-2026-18446

Immediate Actions Required

Upgrade fast-uri to 4.1.2, 3.1.5, or 2.4.4 depending on the major version in use
Audit transitive dependencies with npm ls fast-uri and force resolutions through overrides in package.json where direct upgrade is not possible
Review all code paths that pass user-supplied URLs through fast-uri before invoking fetch, http.request, or URL

Patch Information

The fast-uri maintainers released fixed versions 4.1.2, 3.1.5, and 2.4.4. Details are published in the GitHub Security Advisory GHSA-7p8r-x3mc-p8w7 and referenced by the OpenJS Foundation Security Advisories.

Workarounds

Normalize backslashes to forward slashes in URL inputs before validation to force consistent parsing across both libraries
Reject URLs containing backslash characters outright when the application does not require them
Perform host validation using Node's native URL parser rather than fast-uri for security-sensitive decisions

bash

# Upgrade fast-uri to a patched version
npm install fast-uri@^4.1.2

# Enforce a patched version across transitive dependencies
# package.json
# "overrides": {
#   "fast-uri": "^4.1.2"
# }
npm install
npm ls fast-uri