UBUNTU-CVE-2026-18446

🗓️ 31 Jul 2026 15:16:00Reported by GoogleType

osv🔗 osv.dev👁 7 Views

Backslashes bypass fast-uri host checks, causing host mismatch with Node URL; upgrade to fast-uri 4.1.2, 3.1.5, or 2.4.4.

Reporter	Title	Published	Views	Family All 268
IBM Security Bulletins	Security Bulletin: fast-uri versions from 2.3.1 through 4.1.0 (including the 3.x line up to 3.1.3 and the 2.x line up to 2.4.2) do not treat a literal backslash character (U+005C) as an authority delimiter	9 Sep 202620:14	–	ibm
IBM Security Bulletins	Security Bulletin: There are vulnerabilities in IBM Maximo Manage application in IBM Maximo Application Suite	28 Aug 202605:59	–	ibm
IBM Security Bulletins	Security Bulletin: IBM App Connect Enterprise is vulnerable to multiple vulnerabilities due to multiple Node.js modules	7 Sep 202612:37	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Transformation Advisor is affected by multiple vulnerabilities found in Java, JavaScript and IBM WebSphere Application Server Liberty	28 Aug 202610:08	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple Vulnerabilities in IBM watsonx Code Assistant On Prem	15 Sep 202615:42	–	ibm
IBM Security Bulletins	Security Bulletin: IBM ApplinX is vulnerable to being directed to unintended host due to the use of fast-uri (CVE-2026-18446)	7 Sep 202607:57	–	ibm
Atlassian	Injection fast-uri Dependency in Bamboo Data Center	7 Aug 202616:31	–	atlassian
Atlassian	Injection fast-uri Dependency in Bitbucket Data Center	11 Aug 202611:30	–	atlassian
Atlassian	Injection fast-uri Dependency in Jira Service Management Data Center	1 Sep 202617:31	–	atlassian
Atlassian	Injection fast-uri Dependency in Jira Software Data Center	1 Sep 202617:31	–	atlassian

Source	Link
ubuntu	www.ubuntu.com/security/CVE-2026-18446
cve	www.cve.org/CVERecord
github	www.github.com/fastify/fast-uri/security/advisories/GHSA-7p8r-x3mc-p8w7
cna	www.cna.openjsf.org/security-advisories.html

06 Aug 2026 00:12Current

5.5Medium risk

Vulners AI Score5.5

CVSS 3.17.5

EPSS0.00221