{"id":"ghsa-ghsa-wjr9-j795-jxcr","seq":661315,"kind":"advisory","title":"fast-uri vulnerable to host confusion via unchecked WHATWG host canonicalization","url":"https://github.com/advisories/GHSA-wjr9-j795-jxcr","permalink":"https://vulnpulse.app/items/ghsa-ghsa-wjr9-j795-jxcr","summary":"影響: npm:fast-uri >= 2.4.2, < 2.4.8 → 2.4.8, npm:fast-uri >= 3.1.3, < 3.1.9 → 3.1.9, npm:fast-uri >= 4.0.1, < 4.2.3 → 4.2.3\nfast-uri versions >= 2.4.2, = 3.1.3, = 4.0.1, <= 4.2.2 can silently rewrite the host of an HTTP-family URL (http, https, ws, wss, or any scheme with domainHost: true). For those schemes canonicalizeHost() passes the parsed host to the WHATWG URL parser and adopts its .hostname without checking that the parser read the whole input as a host. RFC 3986 permits @ inside the host group and the WHATWG parser strips TAB, LF, and CR, so the authority fast-uri reports is rewritten by that second parser…","severity":"medium","techs":["nodejs"],"cves":["CVE-2026-110180"],"tags":["GHSA-wjr9-j795-jxcr","fast-uri","fast-uri","fast-uri"],"source":{"id":"ghsa","name":"GitHub Advisory Database"},"published_at":"2026-10-23T21:37:59.000Z","fetched_at":"2026-10-24T04:50:51.468Z"}