Copyright © 2012 Red Hat, Inc. All rights reserved.
Important
2026-07-31T14:37:01
fast-uri: fast-uri: Host confusion vulnerability via backslash in URI authority
7.5
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
CWE-1289
fast-uri before 4.1.2, 3.1.5, and 2.4.4 requires a literal double forward slash to recognize a URI authority, so a reference that uses a backslash based introducer in place of it (backslash backslash, forward slash backslash, or backslash forward slash) is parsed with no authority and folds into the path. Node's native WHATWG URL parser instead treats a backslash as interchangeable with a forward slash for special schemes, so the two parsers extract different hosts from the same input. Applications that use fast-uri to enforce host based policy such as allowlists, SSRF filtering, or redirect validation before passing the same URL into Node's URL or fetch consumers can be steered to an unintended host. Upgrade to fast-uri 4.1.2, 3.1.5, or 2.4.4.
A flaw was found in fast-uri. This vulnerability arises because fast-uri incorrectly parses Uniform Resource Identifiers (URIs) when a backslash is used in place of a forward slash to introduce the authority component. This discrepancy with Node's native WHATWG URL parser can lead to host confusion. A remote attacker could exploit this to bypass security policies, such as allowlists or Server-Side Request Forgery (SSRF) filters, potentially redirecting applications to unintended hosts.
Red Hat Hardened Images
2026-08-01T00:00:00Z
RHSA-2026:49387
grafana13-1-main-13.1.1-0.4.hum1
Red Hat Hardened Images
2026-08-01T00:00:00Z
RHSA-2026:49401
grafana12-4-main-12.4.6-0.3.hum1
Cryostat 4
Under investigation
cryostat-openshift-console-plugin-npm
Cryostat 4
Under investigation
grafana-infinity-datasource-npm
Migration Toolkit for Applications 8
Under investigation
mta/mta-solution-server-rhel9
Migration Toolkit for Containers
Under investigation
rhmtc/openshift-migration-ui-rhel8
Multicluster Engine for Kubernetes
Under investigation
multicluster-engine/console-mce-rhel9
Network Observability Operator
Under investigation
network-observability/network-observability-console-plugin-pf5-rhel9
Network Observability Operator
Under investigation
network-observability/network-observability-console-plugin-rhel9
OpenShift Lightspeed
Under investigation
openshift-lightspeed/lightspeed-agentic-console-rhel9
OpenShift Lightspeed
Under investigation
openshift-lightspeed/lightspeed-console-plugin-419-rhel9
OpenShift Lightspeed
Under investigation
openshift-lightspeed/lightspeed-console-plugin-pf5-rhel9
OpenShift Lightspeed
Under investigation
openshift-lightspeed/lightspeed-console-plugin-rhel9
OpenShift Pipelines
Under investigation
openshift-pipelines/pipelines-console-plugin-pf5-rhel9
OpenShift Pipelines
Under investigation
openshift-pipelines/pipelines-console-plugin-rhel8
OpenShift Pipelines
Under investigation
openshift-pipelines/pipelines-console-plugin-rhel9
OpenShift Pipelines
Under investigation
openshift-pipelines/pipelines-hub-ui-rhel8
OpenShift Pipelines
Under investigation
openshift-pipelines/pipelines-hub-ui-rhel9
OpenShift Serverless
Under investigation
openshift-serverless-1/kn-eventing-integrations-aws-ddb-streams-source-rhel9
OpenShift Serverless
Under investigation
openshift-serverless-1/kn-eventing-integrations-aws-s3-sink-rhel9
OpenShift Serverless
Under investigation
openshift-serverless-1/kn-eventing-integrations-aws-s3-source-rhel9
OpenShift Serverless
Under investigation
openshift-serverless-1/kn-eventing-integrations-aws-sns-sink-rhel9
OpenShift Serverless
Under investigation
openshift-serverless-1/kn-eventing-integrations-aws-sqs-sink-rhel9
OpenShift Serverless
Under investigation
openshift-serverless-1/kn-eventing-integrations-aws-sqs-source-rhel9
OpenShift Serverless
Under investigation
openshift-serverless-1/kn-eventing-integrations-log-sink-rhel9
OpenShift Serverless
Under investigation
openshift-serverless-1/kn-eventing-integrations-timer-source-rhel9
OpenShift Serverless
Under investigation
openshift-serverless-1/kn-eventing-integrations-transform-jsonata-rhel9
Red Hat 3scale API Management Platform 2
Under investigation
3scale-amp21/system
Red Hat 3scale API Management Platform 2
Under investigation
3scale-amp22/system
Red Hat 3scale API Management Platform 2
Under investigation
3scale-amp2/system-rhel7
Red Hat 3scale API Management Platform 2
Under investigation
3scale-amp2/system-rhel8
Red Hat 3scale API Management Platform 2
Under investigation
3scale-amp2/system-rhel9
Red Hat Advanced Cluster Management for Kubernetes 2
Under investigation
rhacm2/console-rhel9
Red Hat AMQ Broker 7
Under investigation
amq-broker-bin.zip
Red Hat AMQ Broker 7
Under investigation
amq-broker-maven-repository.zip
Red Hat Ansible Automation Platform 2
Under investigation
ansible-automation-platform-24/lightspeed-rhel8
Red Hat Ansible Automation Platform 2
Under investigation
ansible-automation-platform-25/lightspeed-rhel8
Red Hat Ansible Automation Platform 2
Under investigation
ansible-automation-platform-26/gateway-rhel9
Red Hat Ansible Automation Platform 2
Under investigation
ansible-automation-platform-26/lightspeed-rhel9
Red Hat Ansible Automation Platform 2
Under investigation
ansible-automation-platform-27/gateway-rhel9
Red Hat Ansible Automation Platform 2
Under investigation
ansible-automation-platform-27/mcp-server-rhel9
Red Hat Ansible Automation Platform 2
Under investigation
ansible-automation-platform-tech-preview/mcp-server-rhel9
Red Hat Ansible Automation Platform 2
Under investigation
automation-gateway
Red Hat Ansible Automation Platform 2
Under investigation
automation-platform-ui
Red Hat build of Apache Camel - HawtIO 4
Under investigation
fast-uri
Red Hat build of Apicurio Registry 3
Under investigation
apicurio/apicurio-registry-ui-rhel8
Red Hat build of Apicurio Registry 3
Under investigation
apicurio/apicurio-registry-ui-rhel9
Red Hat Build of Podman Desktop
Under investigation
rh-podman-desktop.git
Red Hat Connectivity Link 1
Under investigation
rhcl-1/rhcl-console-plugin-rhel9
Red Hat Data Grid 8
Under investigation
redhat-datagrid-maven-repository.zip
Red Hat Developer Hub
Under investigation
rhdh/red-hat-developer-hub-backstage-plugin-lightspeed
Red Hat Developer Hub
Under investigation
rhdh/red-hat-developer-hub-backstage-plugin-lightspeed-backend
Red Hat Developer Hub
Under investigation
rhdh/red-hat-developer-hub-backstage-plugin-orchestrator
Red Hat Developer Hub
Under investigation
rhdh/red-hat-developer-hub-backstage-plugin-orchestrator-backend
Red Hat Developer Hub
Under investigation
rhdh/red-hat-developer-hub-backstage-plugin-orchestrator-backend-module-loki
Red Hat Developer Hub
Under investigation
rhdh/red-hat-developer-hub-backstage-plugin-orchestrator-form-widgets
Red Hat Developer Hub
Under investigation
rhdh/red-hat-developer-hub-backstage-plugin-scaffolder-backend-module-orchestrator
Red Hat Developer Hub
Under investigation
rhdh/rhdh-hub-rhel9
Red Hat Discovery 2
Under investigation
discovery/discovery-ui-rhel9
Red Hat Edge Manager 1
Under investigation
rhem/flightctl-ui-ocp-rhel10
Red Hat Edge Manager 1
Under investigation
rhem/flightctl-ui-ocp-rhel9
Red Hat Edge Manager 1
Under investigation
rhem/flightctl-ui-rhel10
Red Hat Edge Manager 1
Under investigation
rhem/flightctl-ui-rhel9
Red Hat Enterprise Linux 10
Under investigation
linux-sgx
Red Hat Enterprise Linux 9
Under investigation
linux-sgx
Red Hat Enterprise Linux AI (RHEL AI) 3
Under investigation
rhelai3/bootc-cuda-rhel9
Red Hat Enterprise Linux AI (RHEL AI) 3
Under investigation
rhelai3/bootc-gaudi-rhel9
Red Hat Enterprise Linux AI (RHEL AI) 3
Under investigation
rhelai3/bootc-rocm-rhel9
Red Hat Enterprise Linux AI (RHEL AI) 3
Under investigation
rhelai3/disk-image-cuda-rhel9
Red Hat Hardened Images
Not affected
dotnet8.0
Red Hat Hardened Images
Not affected
jaeger
Red Hat Hardened Images
Not affected
prometheus3.13
Red Hat OpenShift AI (RHOAI)
Under investigation
rhoai/odh-dashboard-rhel9
Red Hat OpenShift AI (RHOAI)
Under investigation
rhoai/odh-mlflow-rhel9
Red Hat OpenShift AI (RHOAI)
Under investigation
rhoai/odh-mod-arch-automl-rhel9
Red Hat OpenShift AI (RHOAI)
Under investigation
rhoai/odh-mod-arch-autorag-rhel9
Red Hat OpenShift AI (RHOAI)
Under investigation
rhoai/odh-mod-arch-eval-hub-rhel9
Red Hat OpenShift AI (RHOAI)
Under investigation
rhoai/odh-mod-arch-gen-ai-rhel9
Red Hat OpenShift AI (RHOAI)
Under investigation
rhoai/odh-mod-arch-maas-rhel9
Red Hat OpenShift AI (RHOAI)
Under investigation
rhoai/odh-mod-arch-mlflow-rhel9
Red Hat OpenShift AI (RHOAI)
Under investigation
rhoai/odh-mod-arch-model-registry-rhel9
Red Hat OpenShift Container Platform 4
Under investigation
openshift4/nmstate-console-plugin-rhel9
Red Hat OpenShift Container Platform 4
Under investigation
openshift4/ose-agent-installer-ui-rhel9
Red Hat OpenShift Container Platform 4
Under investigation
openshift4/ose-console-rhel9
Red Hat OpenShift Container Platform 4
Under investigation
openshift4/ose-monitoring-plugin-rhel9
Red Hat Openshift Data Foundation 4
Under investigation
odf4/mcg-core-rhel9
Red Hat Openshift Data Foundation 4
Under investigation
odf4/ocs-client-console-rhel9
Red Hat Openshift Data Foundation 4
Under investigation
odf4/odf-console-rhel9
Red Hat Openshift Data Foundation 4
Under investigation
odf4/odf-multicluster-console-rhel9
Red Hat OpenShift Dev Spaces
Under investigation
devspaces/code-rhel9
Red Hat OpenShift Dev Spaces
Under investigation
devspaces/dashboard-rhel9
Red Hat Quay 3
Under investigation
quay/quay-rhel8
Red Hat Quay 3
Under investigation
quay/quay-rhel9
Red Hat Satellite 6
Under investigation
nodejs-compression-webpack-plugin
Red Hat Satellite 6
Under investigation
nodejs-mini-css-extract-plugin
Red Hat Satellite 6
Under investigation
nodejs-webpack
Red Hat Satellite 6
Under investigation
satellite/iop-advisor-frontend-rhel9
Red Hat Satellite 6
Under investigation
satellite/iop-host-inventory-frontend-rhel9
Red Hat Satellite 6
Under investigation
satellite/iop-remediations-rhel9
Red Hat Satellite 6
Under investigation
satellite/iop-vulnerability-frontend-rhel9
Secrets Management Console for Red Hat OpenShift
Under investigation
external-secrets-management/console-plugin-rhel9
Self-service automation portal 2
Under investigation
ansible-automation-platform/automation-portal
Self-service automation portal 2
Under investigation
ansible-automation-platform/bootc-automation-portal-rhel9
https://www.cve.org/CVERecord?id=CVE-2026-18446
https://nvd.nist.gov/vuln/detail/CVE-2026-18446
https://cna.openjsf.org/security-advisories.html
https://github.com/fastify/fast-uri/security/advisories/GHSA-7p8r-x3mc-p8w7