CVE-2026-18446

fast-uri before 4.1.2, 3.1.5, and 2.4.4 requires a literal double forward slash to recognize a URI authority, so a reference that uses a backslash based introducer in place of it (backslash backslash, forward slash backslash, or backslash forward slash) is parsed with no authority and folds into the path. Node's native WHATWG URL parser instead treats a backslash as interchangeable with a forward slash for special schemes, so the two parsers extract different hosts from the same input. Applications that use fast-uri to enforce host based policy such as allowlists, SSRF filtering, or redirect validation before passing the same URL into Node's URL or fetch consumers can be steered to an unintended host. Upgrade to fast-uri 4.1.2, 3.1.5, or 2.4.4.

• CWE-436

• https://cna.openjsf.org/security-advisories.htmlVendor Advisory
• https://github.com/fastify/fast-uri/security/advisories/GHSA-7p8r-x3mc-p8w7Vendor Advisory

Published

Jul 31, 2026

Last Modified

Sep 2, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-18439The Tutor LMS – eLearning and online course solution plugin …4.3
• CVE-2026-1844The PixelYourSite PRO plugin for WordPress is vulnerable to …7.2
• CVE-2026-18441The Appointment Booking Plugin – LatePoint | Calendar & Sche…4.3
• CVE-2026-18442The WCFM Marketplace – Multivendor Marketplace for WooCommer…7.5
• CVE-2026-18444There is an integer conversion vulnerability resulting in an…7.8
• CVE-2026-18445There is an integer overflow vulnerability resulting in an o…7.8
• CVE-2026-1845The Real Estate Pro plugin for WordPress is vulnerable to St…5.5
• CVE-2026-18452DMS+ (Non-Mobile) developed by Rich Source has a Use of Hard…10
• CVE-2026-18453A flaw was found in 389 Directory Server. A missing NULL poi…7.5
• CVE-2026-18457Heap-based Buffer Overflow vulnerability in RTI Connext Prof…8.3
• CVE-2026-18458Out-of-bounds Read, Function Call With Incorrect Number of A…6.8
• CVE-2026-18459Incorrect Calculation vulnerability in RTI Connext Professio…8.7