fast-uri: fast-uri: Host confusion vulnerability via backslash in URI authority

🗓️ 01 Aug 2026 14:28:52Reported by RedHatType

redhat🔗 access.redhat.com👁 13 Views

Fast-uri parses URIs with backslash in authority, causing host confusion and allowlist and SSRF bypass.

Reporter	Title	Published	Views	Family All 261
IBM Security Bulletins	Security Bulletin: fast-uri versions from 2.3.1 through 4.1.0 (including the 3.x line up to 3.1.3 and the 2.x line up to 2.4.2) do not treat a literal backslash character (U+005C) as an authority delimiter	9 Sep 202620:14	–	ibm
IBM Security Bulletins	Security Bulletin: There are vulnerabilities in IBM Maximo Manage application in IBM Maximo Application Suite	28 Aug 202605:59	–	ibm
IBM Security Bulletins	Security Bulletin: IBM App Connect Enterprise is vulnerable to multiple vulnerabilities due to multiple Node.js modules	7 Sep 202612:37	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Transformation Advisor is affected by multiple vulnerabilities found in Java, JavaScript and IBM WebSphere Application Server Liberty	28 Aug 202610:08	–	ibm
IBM Security Bulletins	Security Bulletin: IBM ApplinX is vulnerable to being directed to unintended host due to the use of fast-uri (CVE-2026-18446)	7 Sep 202607:57	–	ibm
Atlassian	Injection fast-uri Dependency in Bamboo Data Center	7 Aug 202616:31	–	atlassian
Atlassian	Injection fast-uri Dependency in Bitbucket Data Center	11 Aug 202611:30	–	atlassian
Chainguard	CVE-2026-18446 vulnerabilities	4 Aug 202620:23	–	cgr
Circl	CVE-2026-18446	31 Jul 202616:58	–	circl
CVE	CVE-2026-18446	31 Jul 202614:37	–	cve

OS	OS Version	Architecture	Package	Package Version	Filename
Red Hat Hardened Images	any	aarch64	grafana12.4	12.4.6-0.3.hum1	grafana12.4-12.4.6-0.3.hum1.aarch64.rpm
Red Hat Hardened Images	any	x86_64	grafana12.4	12.4.6-0.3.hum1	grafana12.4-12.4.6-0.3.hum1.x86_64.rpm

Source	Link
access	www.access.redhat.com/security/cve/CVE-2026-18446
bugzilla	www.bugzilla.redhat.com/show_bug.cgi
cna	www.cna.openjsf.org/security-advisories.html
github	www.github.com/fastify/fast-uri/security/advisories/GHSA-7p8r-x3mc-p8w7
nvd	www.nvd.nist.gov/vuln/detail/CVE-2026-18446
cve	www.cve.org/CVERecord

10 Sep 2026 09:00Current

5.5Medium risk

Vulners AI Score5.5

CVSS 3.17.5

EPSS0.00221

SSVC

fast-uri host confusion backslash authority ssrf bypass allowlist bypass