THREAT OPS › Threat News › [GHSA] GHSA-7p8r-x3mc-p8w7 (high) — fast-uri vulnerable to host confusion via backslash authority introducer
[GHSA] GHSA-7p8r-x3mc-p8w7 (high) — fast-uri vulnerable to host confusion via backslash authority introducer
GHSA-7p8r-x3mc-p8w7 Severity: high CVE: CVE-2026-18446
fast-uri vulnerable to host confusion via backslash authority introducer
### Impact
`fast-uri` v4.1.1 and earlier require a literal `//` to recognize a URI authority, so a reference that uses `\\`, `/\`, or `\/` as the authority introducer (in place of `//`, after an optional scheme) is parsed with no authority: the sequence and everything
Indicators of compromise
- CVE-2026-18446cve
- https://allowed.com/`url
- https://allowed.com/%5C%5Cevil.com/path`url
- https://evil.com/path`url
- 5cevil.comdomain
Original source: https://github.com/advisories/GHSA-7p8r-x3mc-p8w7