high · 7.5CVE-2026-18446Aug 3, 2026

CVE-2026-18446: fast-uri Host Confusion via Backslash Authority Introducer

Rohit Hatagale
AI Security Researcher, SecureLayer7

A URL passed to fast-uri for allowlist or SSRF validation can use backslash characters in place of the normal // authority prefix, causing fast-uri and Node's native fetch/URL to disagree on the…

Packagefast-uri
Ecosystemnpm
Affected< 2.4.4
Fixed in2.4.4
CVE-2026-18446: fast-uri Host Confusion via Backslash Authority Introducer

The problem

fast-uri requires a literal // to recognize a URI authority. A reference using \\, /\, or \/ as the authority introducer is parsed with no authority at all. The entire sequence folds into the path component.

Node's WHATWG URL parser (used by fetch(), undici, and the built-in http/https clients) treats \ as equivalent to / for special schemes (http, https, ws, wss, ftp, file). The two parsers extract completely different hosts from the same string.

Any code that validates a URL with fast-uri and then fetches with Node's stack can be bypassed.

Proof of concept

A working proof-of-concept for CVE-2026-18446 in fast-uri, with the exact payload below.

javascript
// Bypass: fast-uri sees no authority (path only), Node fetch() hits evil.com
const fastUri = require('fast-uri')

// Variant 1: backslash authority introducer (relative reference resolved against trusted base)
// fast-uri resolves to: https://allowed.com/%5C%5Cevil.com/path  (stays on allowed.com)
// Node WHATWG URL resolves to: https://evil.com/path  (navigates to evil.com)
const ref = '\\\\evil.com/path'
const base = 'https://allowed.com/'
const resolved = fastUri.resolve(base, ref)
// resolved === 'https://allowed.com/%5C%5Cevil.com/path'  <- policy says PASS
// but: new URL(ref, base).href === 'https://evil.com/path'  <- actual destination

// Variant 2: mixed slash introducer
const ref2 = '\/evil.com/path'
// fast-uri: https://allowed.com/%5C/evil.com/path  (still on allowed.com)
// WHATWG:   https://evil.com/path

// Variant 3: forward-backslash introducer
const ref3 = '/\\evil.com/path'
// fast-uri: https://allowed.com/%5C/evil.com/path
// WHATWG:   https://evil.com/path

The root cause is a parser interpretation conflict (CWE-436). fast-uri's RFC 3986 regex only triggers authority parsing when it sees a literal //. Backslash variants (\\, /\, \/) do not match, so the parser treats them as opaque path characters and percent-encodes them on resolution, keeping the result scoped to the base host.

The WHATWG URL Standard (Section 5.1) explicitly maps \ to / during the authority/path state machine for special schemes, so Node's native parser strips the backslash and resolves a real authority. The desync is a validate-then-use race: fast-uri says trusted host, Node.js fetches an entirely different one.

The patch (commit f3c6c905) normalizes any \ to / in the authority and path region before fast-uri's own parsing begins, for special schemes only. This aligns fast-uri's behavior with the WHATWG standard and closes the gap.

The fix

Upgrade to fast-uri 2.4.4, 3.1.5, or 4.1.2. No workaround exists. The patch pre-normalizes backslashes to forward slashes for special schemes before authority extraction, matching Node's WHATWG URL behavior.

Reported by rampage0010.

References: [1][2][3][4][5][6]

Related research