Read the docs
TI-2026-15158 Aliases CVE-2026-18446GHSA-7p8r-x3mc-p8w7

fast-uri vulnerable to host confusion via backslash authority introducer

Priority LOW 39CWE-436Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
None · High · None
Fix status
Partial Red Hat: 6 fixed, 16 without a fix

Attack profile from CVSS 3.1 · CNA. Fix status from CNA, GitHub and Red Hat.

Summary

fast-uri before 4.1.2, 3.1.5, and 2.4.4 requires a literal double forward slash to recognize a URI authority, so a reference that uses a backslash based introducer in place of it (backslash backslash, forward slash backslash, or backslash forward slash) is parsed with no authority and folds into the path. Node's native WHATWG URL parser instead treats a backslash as interchangeable with a forward slash for special schemes, so the two parsers extract different hosts from the same input. Applications that use fast-uri to enforce host based policy such as allowlists, SSRF filtering, or redirect validation before passing the same URL into Node's URL or fetch consumers can be steered to an unintended host. Upgrade to fast-uri 4.1.2, 3.1.5, or 2.4.4.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.0038 32nd percentileScored 2026-11-07
Fix Partial fast-uri (fast-uri): 4.1.2, 3.1.5, 2.4.4fast-uri (npm): 2.4.4, 3.1.5, 4.1.2Red Hat: 9 advisoriesRed Hat: 6 fixed, 16 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
fast-urifast-uri4.0.0 to before 4.1.2; 3.0.0 to before 3.1.5; before 2.4.44.1.2, 3.1.5, 2.4.4Patch availableCNA
—fast-uri (npm)before 2.4.42.4.4Patch availableGHSA-7p8r-x3mc-p8w7
—fast-uri (npm)3.0.0 to before 3.1.53.1.5Patch availableGHSA-7p8r-x3mc-p8w7
—fast-uri (npm)4.0.0 to before 4.1.24.1.2Patch availableGHSA-7p8r-x3mc-p8w7
  • fast-uri Vendorfast-uri Affected 4.0.0 to before 4.1.2; 3.0.0 to before 3.1.5; before 2.4.4 Fixed in 4.1.2, 3.1.5, 2.4.4 Patch available CNA
  • fast-uri (npm) Vendor— Affected before 2.4.4 Fixed in 2.4.4 Patch available GHSA-7p8r-x3mc-p8w7
  • fast-uri (npm) Vendor— Affected 3.0.0 to before 3.1.5 Fixed in 3.1.5 Patch available GHSA-7p8r-x3mc-p8w7
  • fast-uri (npm) Vendor— Affected 4.0.0 to before 4.1.2 Fixed in 4.1.2 Patch available GHSA-7p8r-x3mc-p8w7

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:openjsf:fast-uri:*:*:*:*:*:node.js:*:*before 2.4.4; 3.0.0 to before 3.1.5; 4.0.0 to before 4.1.2Vulnerablefast-uri
  • cpe:2.3:a:openjsf:fast-uri:*:*:*:*:*:node.js:*:* Versions before 2.4.4; 3.0.0 to before 3.1.5; 4.0.0 to before 4.1.2 Vulnerable ·fast-uri

Remediation

  • Fix · CNA fast-uri (fast-uri) Fixed in 4.1.2, 3.1.5, 2.4.4
  • Fix · GHSA-7p8r-x3mc-p8w7 fast-uri (npm) Fixed in 2.4.4 Advisory →
  • Fix · GHSA-7p8r-x3mc-p8w7 fast-uri (npm) Fixed in 3.1.5 Advisory →
  • Fix · GHSA-7p8r-x3mc-p8w7 fast-uri (npm) Fixed in 4.1.2 Advisory →

Red Hat 9 advisories

  • RHSA-2026:92510 Released 2026-10-29 · Red Hat rating Critical
    RHOAI 3.4.6 - Red Hat OpenShift AI
    • Red Hat OpenShift AI 3.4 registry.redhat.io/rhoai/odh-built-in-detector-rhel9, registry.redhat.io/rhoai/odh-cli-rhel9, registry.redhat.io/rhoai/odh-dashboard-rhel9 +47
  • RHSA-2026:87410 Released 2026-10-21 · Red Hat rating Critical
    RHOAI 2.25.12 - Red Hat OpenShift AI
    • Red Hat OpenShift AI 2.25 registry.redhat.io/rhoai/odh-built-in-detector-rhel9, registry.redhat.io/rhoai/odh-caikit-nlp-rhel9, registry.redhat.io/rhoai/odh-codeflare-operator-rhel9 +47
  • RHSA-2026:84734 Released 2026-10-19 · Red Hat rating Critical
    RHOAI 3.4.5 - Red Hat OpenShift AI
    • Red Hat OpenShift AI 3.4 registry.redhat.io/rhoai/odh-ai-gateway-payload-processing-rhel9, registry.redhat.io/rhoai/odh-automl-rhel9, registry.redhat.io/rhoai/odh-autorag-rhel9 +47
Show 6 more Red Hat advisories
  • RHSA-2026:71454 Released 2026-09-29 · Red Hat rating Important
    OpenShift Container Platform 4.22.16 bug fix and security update
    • Red Hat OpenShift Container Platform 4.22 registry.redhat.io/openshift4/aws-node-termination-handler-rhel9, registry.redhat.io/openshift4/ose-agent-installer-ui-rhel9, registry.redhat.io/openshift4/ose-cluster-cloud-controller-manager-rhel9-operator +8
  • RHSA-2026:68553 Released 2026-09-22 · Red Hat rating Important
    OpenShift Container Platform 4.22.15 security and extras update
    • Red Hat OpenShift Container Platform 4.22 registry.redhat.io/openshift4/nmstate-console-plugin-rhel9, registry.redhat.io/openshift4/ose-sriov-network-config-daemon-rhel9, registry.redhat.io/openshift4/ose-sriov-network-rhel9-operator
  • RHSA-2026:68547 Released 2026-09-22 · Red Hat rating Important
    OpenShift Container Platform 4.21.34 security and extras update
    • Red Hat OpenShift Container Platform 4.21 registry.redhat.io/openshift4/nmstate-console-plugin-rhel9, registry.redhat.io/openshift4/ose-node-feature-discovery-rhel9, registry.redhat.io/openshift4/ose-sriov-network-config-daemon-rhel9 +1
  • RHSA-2026:62550 Released 2026-09-10 · Red Hat rating Important
    OpenShift Container Platform 4.16.70 bug fix and security update
    • Red Hat OpenShift Container Platform 4.16 registry.redhat.io/openshift4/egress-router-cni-rhel9, registry.redhat.io/openshift4/ose-cli-artifacts-rhel9, registry.redhat.io/openshift4/ose-cli-rhel9 +15
  • RHSA-2026:49401 Released 2026-08-01 · Red Hat rating Important
    Red Hat Hardened Images RPMs Security Update
    • Red Hat Hardened Images grafana12.4-12.4.6-0.3.hum1@aarch64, grafana12.4-12.4.6-0.3.hum1@src, grafana12.4-12.4.6-0.3.hum1@x86_64
  • RHSA-2026:49387 Released 2026-08-01 · Red Hat rating Important
    Red Hat Hardened Images RPMs Security Update
    • Red Hat Hardened Images grafana13.1-13.1.1-0.4.hum1@aarch64, grafana13.1-13.1.1-0.4.hum1@src, grafana13.1-13.1.1-0.4.hum1@x86_64

Vendor assessments

Red Hat

Red Hat rating: Important. Red Hat's page for this CVE →

ProductStatusPlan or fix
Migration Toolkit for Applications 8AffectedNo fix yet
OpenShift ServerlessAffectedNo fix yet
Red Hat Build of Podman DesktopAffectedNo fix yet
Red Hat Connectivity Link 1AffectedNo fix yet
Red Hat Edge Manager 1AffectedNo fix planned: Will not fix
Red Hat Enterprise Linux 10AffectedNo fix yet
Red Hat Enterprise Linux 9AffectedNo fix yet
Red Hat Enterprise Linux AI (RHEL AI) 3AffectedNo fix yet
Red Hat OpenShift AI (RHOAI)AffectedNo fix yet
Red Hat OpenShift Container Platform 4AffectedNo fix yet
Red Hat OpenShift Container Platform 5AffectedNo fix yet
Red Hat OpenShift Dev SpacesAffectedNo fix yet
Red Hat Openshift Data Foundation 4AffectedNo fix yet
Red Hat Satellite 6AffectedNo fix yet
Red Hat build of Apache Camel - HawtIO 4AffectedNo fix yet
Red Hat build of Apicurio Registry 3AffectedNo fix yet
Red Hat Hardened ImagesFixed RHSA-2026:49387, RHSA-2026:49401
Red Hat OpenShift AI 2.25Fixed RHSA-2026:87410
Red Hat OpenShift AI 3.4Fixed RHSA-2026:84734, RHSA-2026:92510
Red Hat OpenShift Container Platform 4.16Fixed RHSA-2026:62550
Red Hat OpenShift Container Platform 4.21Fixed RHSA-2026:68547
Red Hat OpenShift Container Platform 4.22Fixed RHSA-2026:68553, RHSA-2026:71454
Not affected: 35 products
  • Cost Management On Premise
  • Cryostat 4
  • Migration Toolkit for Containers
  • Multicluster Engine for Kubernetes
  • Network Observability Operator
  • OpenShift Lightspeed
  • OpenShift Pipelines
  • OpenShift Serverless
  • Red Hat 3scale API Management Platform 2
  • Red Hat AMQ Broker 7
  • Red Hat Advanced Cluster Management for Kubernetes 2
  • Red Hat Ansible Automation Platform 2
  • Red Hat Build of Podman Desktop
  • Red Hat Data Grid 8
  • Red Hat Developer Hub 1
  • Red Hat Directory Server 11
  • Red Hat Directory Server 12
  • Red Hat Discovery 2
  • Red Hat Edge Manager 1
  • Red Hat Enterprise Linux 10
  • Red Hat Enterprise Linux 8
  • Red Hat Enterprise Linux 9
  • Red Hat Hardened Images
  • Red Hat OpenShift AI (RHOAI)
  • Red Hat OpenShift AI 2.25
  • Red Hat OpenShift AI 3.4
  • Red Hat OpenShift Container Platform 4.16
  • Red Hat OpenShift Container Platform 4.21
  • Red Hat OpenShift Container Platform 4.22
  • Red Hat OpenShift Container Platform 5
  • Red Hat OpenShift Dev Spaces
  • Red Hat Quay 3
  • Red Hat Satellite 6
  • Red Hat build of Apache Camel - HawtIO 4
  • Self-service automation portal 2

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-18446
  2. 2026-10-03 Alias added: GHSA-7p8r-x3mc-p8w7
  3. 2026-10-18 Affected versions changed · Red Hat
  4. 2026-10-18 Affected versions changed · Red Hat
  5. 2026-10-20 Fix available: RHSA-2026:84734 · Red Hat
  6. 2026-10-20 Fix available: Red Hat OpenShift AI 3.4 · Red Hat
  7. 2026-10-22 Fix available: RHSA-2026:87410 · Red Hat
  8. 2026-10-23 Fix available: Red Hat OpenShift AI 2.25 · Red Hat
  9. 2026-10-24 Affected versions changed · Red Hat
  10. 2026-10-27 Affected versions changed · Red Hat
  11. 2026-10-30 Fix available: RHSA-2026:92510 · Red Hat
  12. 2026-10-30 Affected versions changed · Red Hat
  13. 2026-10-30 Affected versions changed · Red Hat
  14. 2026-10-30 Affected versions changed · Red Hat

References

Advisory 3

Other 3

  • TI-2026-11539 fast-uri vulnerable to host confusion via failed IDN canonicalization CVSS 3.1HIGH 7.5
  • TI-2026-05545 fast-uri vulnerable to path traversal via percent-encoded dot segments CVSS 3.1HIGH 7.5
  • TI-2026-58005 fast-uri vulnerable to host confusion via an unclosed bracket in the URI authority CVSS 3.1HIGH 7.5
  • TI-2026-53157 fast-uri vulnerable to host confusion via skipped IDN canonicalization on scheme-relative references CVSS 3.1HIGH 7.5
  • TI-2026-13562 fast-uri vulnerable to host confusion via literal backslash authority delimiter CVSS 3.1HIGH 7.5
  • TI-2026-05546 fast-uri vulnerable to host confusion via percent-encoded authority delimiters CVSS 3.1HIGH 7.5
See all 10 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences