fast-uri vulnerable to host confusion via unchecked WHATWG host canonicalization

🗓️ 23 Oct 2026 21:37:59Reported by GitHub Advisory DatabaseType

Host confusion in fast-uri via unchecked WHATWG host canonicalization.

Reporter	Title	Published	Views	Family All 153
Chainguard	CVE-2026-110180 vulnerabilities	25 Oct 202620:54	–	cgr
Circl	CVE-2026-110180	20 Oct 202607:15	–	circl
CNNVD	Fastify fast-uri input validation vulnerability	19 Oct 202616:00	–	cnnvd
CVE	CVE-2026-110180	20 Oct 202607:00	–	cve
Cvelist	CVE-2026-110180 fast-uri vulnerable to host confusion via unchecked WHATWG host canonicalization	20 Oct 202607:00	–	cvelist
Debian CVE	CVE-2026-110180	20 Oct 202607:00	–	debiancve
IBM Security Bulletins	Security Bulletin: IBM ApplinX is vulnerable to multiple vulnerabilities due to use of Angular router and fast-uri libraries.	28 Oct 202611:06	–	ibm
EUVD	EUVD-2026-104813	23 Oct 202621:37	–	euvd
Mend	CVE-2026-110180	20 Oct 202607:00	–	mend
NVD	CVE-2026-110180	20 Oct 202607:17	–	nvd

Vulners

Node

openjsf fast-uriRange4.0.1–4.2.3npm

openjsf fast-uriRange3.1.3–3.1.9npm

openjsf fast-uriRange2.4.2–2.4.8npm

Source	Link
github	www.github.com/fastify/fast-uri/security/advisories/GHSA-wjr9-j795-jxcr
nvd	www.nvd.nist.gov/vuln/detail/CVE-2026-110180
github	www.github.com/fastify/fast-uri/commit/58c183d0b168ad87f98773266444ce1f6375803a
github	www.github.com/fastify/fast-uri/commit/ddfc6a51122dfce0365655f04479fc3adb7f6b3c
github	www.github.com/fastify/fast-uri/commit/f6d46dfeab025d0c440485f4ae29fa4f14707646
cna	www.cna.openjsf.org/security-advisories.html
github	www.github.com/fastify/fast-uri/releases/tag/v2.4.8
github	www.github.com/fastify/fast-uri/releases/tag/v3.1.9
github	www.github.com/fastify/fast-uri/releases/tag/v4.2.3
github	www.github.com/advisories/GHSA-wjr9-j795-jxcr

23 Oct 2026 21:38Current

5.9Medium risk

Vulners AI Score5.9

CVSS 3.14.8

EPSS0.00255

SSVC