Results for "CVE-2026-110180"
Sat, October 24Yesterday
fast-uri vulnerable to host confusion via unchecked WHATWG host canonicalization
影響: npm:fast-uri >= 2.4.2, < 2.4.8 → 2.4.8, npm:fast-uri >= 3.1.3, < 3.1.9 → 3.1.9, npm:fast-uri >= 4.0.1, < 4.2.3 → 4.2.3 fast-uri versions >= 2.4.2, = 3.1.3, = 4.0.1, <= 4.2.2 can silently rewrite the host of an HTTP-family URL (http, https, ws, wss, or any scheme with domainHost: true). For those schemes canonicalizeHost() passes the parsed host to the WHATWG URL parser and adopts its .hostname without checking that the parser read the whole input as a host. RFC 3986 permits @ inside the host group and the WHATWG parser strips TAB, LF, and CR, so the authority fast-uri reports is rewritten by that second parser…