CVE-2026-67354

The CVE-2026-67354 entry applies to guzzlehttp/guzzle prior to 7.15.1, where RedirectMiddleware can disclose the URI fragment via the Referer header when allow_redirects.referer is enabled during same-scheme redirects. An attacker controlling the redirect destination may obtain sensitive data (e....

EUVD-2026-51825

guzzlehttp/guzzle versions before 7.15.1 contain an information disclosure vulnerability in RedirectMiddleware. When the optional allowredirects.referer setting is enabled, the middleware copies the URI fragment the portion after '' from the referring request into the generated Referer header whe...

CVE-2026-67354 guzzlehttp/guzzle before 7.15.1 URI Fragment Disclosure via Referer

guzzlehttp/guzzle versions before 7.15.1 contain an information disclosure vulnerability in RedirectMiddleware. When the optional allowredirects.referer setting is enabled, the middleware copies the URI fragment the portion after '' from the referring request into the generated Referer header whe...

sanitize-html has incomplete URI scheme validation in that allows javascript: URIs through action, formaction, data, poster, and background attributes

Summary sanitize-html uses allowedSchemesAppliedToAttributes default: 'href', 'src', 'cite' to gate the naughtyHref function that blocks dangerous URI schemes like javascript: and vbscript:. The HTML specification defines 10+ attributes that accept URIs action, formaction, data, poster, backgroun...

GHSA-VCCV-CMXP-4J9H sanitize-html has incomplete URI scheme validation in that allows javascript: URIs through action, formaction, data, poster, and background attributes

Summary sanitize-html uses allowedSchemesAppliedToAttributes default: 'href', 'src', 'cite' to gate the naughtyHref function that blocks dangerous URI schemes like javascript: and vbscript:. The HTML specification defines 10+ attributes that accept URIs action, formaction, data, poster, backgroun...

NPM: sanitize-html has incomplete URI scheme validation in that allows javascript: URIs through action, formaction, data, poster, and background attributes

NPM: sanitize-html has incomplete URI scheme validation in that allows javascript: URIs through action, formaction, data, poster, and background attributes vulnerability discovered by ? in WordPress Npm sanitize-html versions = 1.18.0, = 2.17.4...

Interpretation Conflict

Overview fast-uri is a Dependency-free RFC 3986 URI toolbox Affected versions of this package are vulnerable to Interpretation Conflict due to malformed authority introducer handling in parseWithStatus and resolve in index.js. An attacker can bypass host-based URL checks and steer requests to an...

@activepieces/piece-ai (>=0.3.1, <=0.3.4), @donadiosolutions/lcm (1.4.2) +10 more potentially affected by CVE-2026-18446 via fast-uri (>=3.0.1, <=3.1.4)

fast-uri NPM version =3.0.1, =0.3.1, =1.2.0, =5.4.3, =0.1.0, =1.0.0, =1.0.0, =1.25.0, =0.1.5, =0.1.0, =2.2.0, =2.3.1 Source cves: CVE-2026-18446 Source advisory: SNYK:JS-FASTURI-18506908...

@datastream/validate (>=0.0.4, <=0.0.38), @dearmrzhang/customs-mcp-server (>=0.1.2, <=1.1.0) +15 more potentially affected by CVE-2026-18446 via fast-uri (>=2.1.0, <=2.3.0)

fast-uri NPM version =2.1.0, =0.0.4, =0.1.2, =0.0.1, =0.0.1, =3.1.0-rc.0, =0.2.0, =0.2.0, =0.2.0, =0.0.1, =0.0.0, =1.0.0, =3.0.0, =1.7.0, =1.8.0 and more Source cves: CVE-2026-18446 Source advisory: SNYK:JS-FASTURI-18506908...

Interpretation Conflict

Overview org.webjars.npm:fast-uri is a Dependency-free RFC 3986 URI toolbox Affected versions of this package are vulnerable to Interpretation Conflict due to malformed authority introducer handling in parseWithStatus and resolve in index.js. An attacker can bypass host-based URL checks and steer...

CVE-2026-18446

fast-uri before 4.1.2, 3.1.5, and 2.4.4 requires a literal double forward slash to recognize a URI authority, so a reference that uses a backslash based introducer in place of it backslash backslash, forward slash backslash, or backslash forward slash is parsed with no authority and folds into th...

CVE-2026-18446

fast-uri before 4.1.2, 3.1.5, and 2.4.4 requires a literal double forward slash to recognize a URI authority, so a reference that uses a backslash based introducer in place of it backslash backslash, forward slash backslash, or backslash forward slash is parsed with no authority and folds into th...

UBUNTU-CVE-2026-18446

fast-uri before 4.1.2, 3.1.5, and 2.4.4 requires a literal double forward slash to recognize a URI authority, so a reference that uses a backslash based introducer in place of it backslash backslash, forward slash backslash, or backslash forward slash is parsed with no authority and folds into th...

Security Bulletin: IBM App Connect Enterprise is vulnerable to multiple vulnerabilities due to multiple Node.js modules

Summary IBM App Connect Enterprise runtime, IBM App Connect Enterprise Discovery Connectors and IBM App Connect Enterprise Connector Discovery and OpenAPI Editor are vulnerable to multiple vulnerabilities due to Node.js modules undici, js-yaml, fast-uri, protobufjs and @opentelemetry/core...

CVE-2026-18446 fast-uri vulnerable to host confusion via backslash authority introducer

fast-uri before 4.1.2, 3.1.5, and 2.4.4 requires a literal double forward slash to recognize a URI authority, so a reference that uses a backslash based introducer in place of it backslash backslash, forward slash backslash, or backslash forward slash is parsed with no authority and folds into th...

CVE-2026-18446 fast-uri vulnerable to host confusion via backslash authority introducer

fast-uri before 4.1.2, 3.1.5, and 2.4.4 requires a literal double forward slash to recognize a URI authority, so a reference that uses a backslash based introducer in place of it backslash backslash, forward slash backslash, or backslash forward slash is parsed with no authority and folds into th...

CVE-2026-18446

CVE-2026-18446 affects the fast-uri library prior to versions 4.1.2, 3.1.5, and 2.4.4 . A backslash-based introducer can substitute for a literal double forward slash required to recognize a URI authority, causing fast-uri to misparse the host while Node’s WHATWG URL parser treats backslashes dif...

@datastream/validate (>=0.0.4, <=0.0.38), @dearmrzhang/customs-mcp-server (>=0.1.2, <=1.1.0) +37 more potentially affected by CVE-2026-18446 via fast-uri (>=1.0.1, <=2.3.0)

fast-uri NPM version =1.0.1, =0.0.4, =0.1.2, =0.0.1, =0.0.1, =1.0.0, =0.19.0-alpha.1682329905.32209c5e, =0.19.0-alpha.1681870131.da1d707d, =0.19.0-alpha.1681870131.da1d707d, =1.0.0, =1.0.2, =2.0.0, =2.0.0, =3.1.0-rc.0, =5.4.2 and more Source cves: CVE-2026-18446 Source advisory: MEND:CVE-2026-184...

@activepieces/piece-ai (>=0.3.1, <=0.3.4), @donadiosolutions/lcm (1.4.2) +10 more potentially affected by CVE-2026-18446 via fast-uri (>=3.0.1, <=3.1.4)

fast-uri NPM version =3.0.1, =0.3.1, =1.2.0, =5.4.3, =0.1.0, =1.0.0, =1.0.0, =1.25.0, =0.1.5, =0.1.0, =2.2.0, =2.3.1 Source cves: CVE-2026-18446 Source advisory: MEND:CVE-2026-18446...

CVE-2026-18446 fast-uri vulnerable to host confusion via backslash authority introducer

fast-uri before 4.1.2, 3.1.5, and 2.4.4 requires a literal double forward slash to recognize a URI authority, so a reference that uses a backslash based introducer in place of it backslash backslash, forward slash backslash, or backslash forward slash is parsed with no authority and folds into th...