fast-uri vulnerable to host confusion via literal backslash authority delimiter
- Severity:
- High
Description
fast-uri v4.1.0 and earlier do not treat a literal backslash (U+005C) as an authority delimiter. Node’s native WHATWG URL (used by fetch(), undici, and Node’s http/https clients) normalizes \ to / for special schemes (http, https, ws, wss, ftp, file), so the two parsers extract different hosts from the same input string.
Recommendation
Update the fast-uri package to the latest compatible version. Followings are version details:
Affected version(s): **>= 4.0.0, <= 4.1.0 >= 3.0.0, <= 3.1.3 >= 2.3.1, <= 2.4.2** Patched version(s): **4.1.1 3.1.4 2.4.3**
References
Related Issues
- fast-uri vulnerable to host confusion via backslash authority introducer - CVE-2026-18446
- fast-uri vulnerable to host confusion via percent-encoded authority delimiters - CVE-2026-6322
- fast-uri vulnerable to host confusion via failed IDN canonicalization - CVE-2026-13676
- fast-uri vulnerable to path traversal via percent-encoded dot segments - CVE-2026-6321
You might also like:
- Tags:
- npm
- fast-uri
Anything's wrong? Let us know Last updated on July 21, 2026