CVE-2026-18446 vulnerabilities

Vulnerabilities for packages: gemini-cli, langfuse, langfuse-fips, argo-workflows, arangodb, nextcloud-server, opensearch-dashboards, opensearch-dashboards-fips, serve, yaml-language-server, saf, unleash-proxy, renovate, prism, librechat, vitess...

CVE-2026-18446 vulnerabilities

Vulnerabilities for packages: vitess, prism, renovate, opensearch-dashboards, serve, langfuse, saf, argo-workflows, yaml-language-server...

CVE-2026-18446

fast-uri before 4.1.2, 3.1.5, and 2.4.4 requires a literal double forward slash to recognize a URI authority, so a reference that uses a backslash based introducer in place of it backslash backslash, forward slash backslash, or backslash forward slash is parsed with no authority and folds into th...