CVE-2026-110180

Name of the Vulnerable Software and Affected Versions fast-uri versions 2.4.2 through 2.4.7 fast-uri versions 3.1.3 through 3.1.8 fast-uri versions 4.0.1 through 4.2.2

Description For HTTP-family schemes, the canonicalizeHost() function passes the parsed host to the WHATWG URL parser and adopts its hostname without verifying that the parser consumed the entire input as a host. This allows the authority to be silently rewritten by dropping data before an at-sign and stripping tab, carriage-return, and line-feed characters without reporting an error. Applications enforcing host-based policies, such as denylists, loopback filtering, redirect validation, or outbound proxy routing, may find that the canonical host diverges from the checked representation, potentially steering traffic to an unintended destination.

Recommendations Update versions 2.4.2 through 2.4.7 to 2.4.8 or later. Update versions 3.1.3 through 3.1.8 to 3.1.9 or later. Update versions 4.0.1 through 4.2.2 to 4.2.3 or later. As a temporary workaround, reject any authority containing more than one at-sign or any tab, carriage-return, or line-feed characters before calling the library, or treat any non-empty parse error as fatal and compare hosts only from the same parse result.