GHSA-7p8r-x3mc-p8w7

Suggest an improvement
Source
https://github.com/advisories/GHSA-7p8r-x3mc-p8w7
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/08/GHSA-7p8r-x3mc-p8w7/GHSA-7p8r-x3mc-p8w7.json
JSON Data
https://api.osv.dev/v1/vulns/GHSA-7p8r-x3mc-p8w7
Aliases
Downstream
CGA (178)
MINI (34)
Published
2026-08-03T19:16:43Z
Modified
2026-09-10T03:50:53Z
Severity
  • 7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N CVSS Calculator
Summary
fast-uri vulnerable to host confusion via backslash authority introducer
Details

Impact

fast-uri v4.1.1 and earlier require a literal // to recognize a URI authority, so a reference that uses \\, /\, or \/ as the authority introducer (in place of //, after an optional scheme) is parsed with no authority: the sequence and everything after it fold into the path. Node's native WHATWG URL (used by fetch(), undici, and Node's http/https clients) instead treats \ as interchangeable with / for special schemes (http, https, ws, wss, ftp, file), so the two parsers extract different hosts from the same input.

For example, fast-uri resolves \\evil.com/path against base https://allowed.com/ to https://allowed.com/%5C%5Cevil.com/path (confined to the trusted host), while Node's WHATWG URL resolves the same reference to https://evil.com/path.

Applications that use fast-uri to enforce host-based policy (allowlists, denylists, loopback/SSRF filtering, redirect validation, outbound proxy routing) before passing the same URL into Node's URL or fetch() consumers see a policy/use desync and can be steered to an unintended destination.

Patches

Upgrade to fast-uri v4.1.2, v3.1.5, v2.4.4.

Workarounds

None. Upgrade to the patched version.

Database specific 
{
    "cwe_ids":  [
        "CWE-436"
    ],
    "github_reviewed":  true,
    "github_reviewed_at":  "2026-08-03T19:16:43Z",
    "nvd_published_at":  "2026-07-31T15:16:27Z",
    "severity":  "HIGH"
}
References

Affected packages

npm / fast-uri

Package

Name
fast-uri
View open source insights on deps.dev
Purl
pkg:npm/fast-uri

Affected ranges

Type
SEMVER
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
2.4.4

Database specific

source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/08/GHSA-7p8r-x3mc-p8w7/GHSA-7p8r-x3mc-p8w7.json"

npm / fast-uri

Package

Name
fast-uri
View open source insights on deps.dev
Purl
pkg:npm/fast-uri

Affected ranges

Type
SEMVER
Events
Introduced
3.0.0
Fixed
3.1.5

Database specific

source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/08/GHSA-7p8r-x3mc-p8w7/GHSA-7p8r-x3mc-p8w7.json"

npm / fast-uri

Package

Name
fast-uri
View open source insights on deps.dev
Purl
pkg:npm/fast-uri

Affected ranges

Type
SEMVER
Events
Introduced
4.0.0
Fixed
4.1.2

Database specific

source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/08/GHSA-7p8r-x3mc-p8w7/GHSA-7p8r-x3mc-p8w7.json"