AIKIDO-2026-236835

fast-uri is vulnerable to Server-Side Request Forgery (SSRF)

Server-Side Request Forgery (SSRF)CVE-2026-18446 Published 2 days ago

High Risk

This Affects:

fast-uri

0.0.1 - 2.4.3

Fixed in 2.4.4

3.0.0 - 3.1.4

Fixed in 3.1.5

4.0.0 - 4.1.1

Fixed in 4.1.2

Are you affected? Scan for Free

TL;DR

fast-uri only treats a literal // as an authority introducer, so references that use \\, /\, \/, or whitespace-split variants after an optional scheme are parsed with no authority and the sequence folds into the path. Node's WHATWG URL (used by fetch(), undici, and Node's HTTP clients) treats \ as interchangeable with / for special schemes, so the same input yields a different host. Applications that enforce host allowlists, SSRF filters, or redirect checks with fast-uri before handing the URL to Node can be steered to an unintended destination. The fix detects these malformed authority introducers, marks the URI malformed, and makes resolve() throw instead of continuing with an unsafe resolution.

Who does this affect?

You are affected if you are using a version that falls within the vulnerable range and you use fast-uri for host-based policy checks before passing the same URL to Node's URL or fetch() consumers.