Listen to this Post
How CVE-2026-18446 Works
The vulnerability stems from a fundamental parsing discrepancy between the `fast-uri` library and Node.js’s native WHATWG URL parser. `fast-uri` v4.1.1 and earlier strictly require a literal `//` sequence to recognize the start of a URI authority component. When it encounters alternative sequences like \\, /\\, or `\/` in place of //, it fails to recognize an authority. Instead, it treats these sequences and everything after them as part of the path, folding them into the path component.
In contrast, Node.js’s native WHATWG URL parser—which is used by critical functions like fetch(), undici, and Node’s http/https clients—treats the backslash (\) as interchangeable with the forward slash (/) for special schemes such as http, https, ws, wss, ftp, and file. This leads to a critical inconsistency: for the exact same input string, the two parsers will extract completely different hosts.
For example, when `fast-uri` resolves the reference `\\evil.com/path` against the base URL https://allowed.com/`, it produceshttps://allowed.com/%5C%5Cevil.com/path`. The host remains allowed.com, as the backslashes are encoded into the path. However, Node’s WHATWG URL resolves the same reference to https://evil.com/path`. The host is nowevil.com.
This discrepancy creates a dangerous policy/use desynchronization. Applications that use `fast-uri` to enforce security policies—such as allowlists, denylists, loopback/SSRF filtering, redirect validation, or outbound proxy routing—before passing the same URL to Node.js consumers can be exploited. An attacker can craft a URL that passes a `fast-uri` policy check (appearing to point to an allowed host) but is then interpreted by Node.js as pointing to a completely different, and potentially malicious, destination. This can lead to Server-Side Request Forgery (SSRF) attacks, allowing access to cloud metadata endpoints, internal hosts, or loopback addresses.
<h2 style="color: blue;">DailyCVE Form:</h2>
Platform: Node.js ecosystem
Version: <=4.1.1, <=3.1.4, <=2.4.3
Vulnerability: Host confusion
Severity: High (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N)
date: 2026-08-03
<h2 style="color: blue;">Prediction: 2026-08-10</h2>
<h2 style="color: blue;">What Undercode Say:</h2>
Check currently installed version of fast-uri
npm list fast-uri
Check for the vulnerability using npm audit
npm audit | grep fast-uri
Example of a vulnerable parsing behavior
This will show the host confusion in action
node -e "const fastUri = require('fast-uri'); const { URL } = require('url'); const base = 'https://allowed.com/'; const malicious = '\\\\evil.com/path'; console.log('fast-uri:', fastUri.resolve(base, malicious)); console.log('Node.js URL:', new URL(malicious, base).href);"
<h2 style="color: blue;">Exploit:</h2>
An attacker can exploit this vulnerability by crafting a URL that uses\,/\`, or `\/` as the authority introducer. If an application uses `fast-uri` to validate that a URL is safe (e.g., checking it against an allowlist of allowed hosts), the malicious URL will pass the check because `fast-uri` incorrectly places the authority within the path. However, when the application subsequently uses Node.js’s native URL parser or `fetch()` to make a request, the URL will be interpreted with a different, attacker-controlled host. This allows an attacker to bypass security controls and potentially access internal resources, such as cloud metadata endpoints, or perform SSRF attacks.
Protection:
Upgrade to a patched version of `fast-uri` immediately. The fixed versions are:
– `fast-uri` v4.1.2 or later
– `fast-uri` v3.1.5 or later
– `fast-uri` v2.4.4 or later
There are no viable workarounds for this vulnerability; upgrading is the only effective mitigation. Organizations should treat this as a high-priority security update.
Impact:
Successful exploitation of this vulnerability allows an attacker to bypass host-based security policies. This can lead to:
– Server-Side Request Forgery (SSRF): An attacker can trick the application into making requests to internal systems, cloud metadata endpoints (e.g., AWS IMDSv1), or loopback addresses.
– Bypassing Security Controls: Allowlists, denylists, and other host-based filtering mechanisms become ineffective, as the attacker can force the application to interact with unintended destinations.
– Internal Network Reconnaissance: Attackers can probe internal network services that are not directly accessible from the outside.
– Data Exfiltration: If internal services or metadata endpoints return sensitive information, an attacker could potentially access it through this vulnerability.
🎯Let’s Practice Exploiting & Learn Patching For Free:
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
