CVE-2026-110180

Medium · 4.8

CVSS

4.8

EPSS

0.3%

Published

Oct 20, 2026

CISA due date

—

Cloudanix analysis

Monitor only SSVC: Track

A Node.js library that handles web addresses can be tricked into changing them silently, letting requests reach the wrong server even when checks are in place.

Exploitation: Remote Unauthenticated
Attacker needs: None
Complexity: High
Impact: Data Tampering
Component: Library
Class: Improper Input Validation
Remediation: Upgrade
Effort: Medium
Patch risk: Low

What it actually does

canonicalizeHost() passes the parsed host to the WHATWG URL parser without verifying full input consumption as host, allowing authority rewriting that drops pre-at-sign data and strips tab/CR/LF characters without error, causing canonical host to diverge from the checked representation for HTTP schemes.

Why it matters to the business

Host-based policies such as denylists, loopback filtering, redirect validation, or proxy routing can be bypassed, allowing traffic to be steered to unintended destinations and increasing risk of data exposure or unauthorized access in dependent Node.js applications.

How an attack unfolds

An attacker crafts a URI containing an at-sign or tab/CR/LF characters in the authority; the application parses it with fast-uri for policy checks but canonicalization silently alters the host, causing the checked host to differ from the effective destination used for outbound requests.

How to fix it

Upgrade fast-uri to 2.4.8, 3.1.9, or 4.2.3 or later. As workaround, reject any authority containing more than one at-sign or any tab/CR/LF before parsing, or treat non-empty parse errors as fatal and compare hosts only from identical parse results.

How to confirm the fix worked

Verify installed fast-uri version is at or above 2.4.8/3.1.9/4.2.3; test parsing of sample URIs containing @ and control characters to confirm host divergence no longer occurs and errors are reported.

Typical attack path

Craft URI with authority containing @ or tab/CR/LF for target host
Submit URI to application endpoint that uses fast-uri parsing for validation
Trigger canonicalizeHost() on HTTP-family scheme
Bypass host policy due to divergent canonical host
Steer request or redirect to attacker-controlled destination

How to detect it

Search application and proxy logs for URIs containing multiple @ symbols or encoded tab/CR/LF in authority components; monitor for ignored parse errors or host mismatches between validation and canonicalization steps.

authority containing %40%40
URI with %09 %0A or %0D in host portion
fast-uri canonicalizeHost call with non-empty error ignored

What your security team should do

Upgrade fast-uri to fixed versions immediately given recent publication
Implement pre-parse authority validation as temporary mitigation
Audit all usages of fast-uri for host-based policy enforcement
Update dependency manifests and rebuild affected Node.js services

The record

fast-uri is a dependency-free RFC 3986 URI parser and serializer for Node.js. In versions from 2.4.2 through 2.4.7, from 3.1.3 through 3.1.8, and from 4.0.1 through 4.2.2, for HTTP-family schemes the canonicalizeHost() function passes the parsed host to the WHATWG URL parser and adopts its hostname without checking that the parser consumed the entire input as a host, so the authority can be silently rewritten: data before an at-sign is dropped and tab, carriage-return, and line-feed characters are stripped, with no error reported. An application that enforces host-based policy such as denylists, loopback filtering, redirect validation, or outbound proxy routing on one representation can then see the canonical host diverge from what it checked, allowing traffic to be steered to an unintended destination. The issue is fixed in fast-uri 2.4.8, 3.1.9, and 4.2.3, and users should upgrade to one of these versions or later. As a workaround, reject an authority that contains more than one at-sign or any tab, carriage-return, or line-feed before calling fast-uri, or treat any non-empty parse error as fatal and compare hosts only from the same parse result.

Affected packages

Ecosystem	Package	Introduced	Fixed