Description
Impact: fast-uri versions from 2.3.1 through 4.1.0 (including the 3.x line up to 3.1.3 and the 2.x line up to 2.4.2) do not treat a literal backslash character (U+005C) as an authority delimiter. Node's native WHATWG URL parser, used by fetch, undici, and Node's http and https clients, normalizes the backslash to a forward slash for special schemes such as http, https, ws, wss, ftp, and file. As a result, the two parsers extract different hosts from the same input string. Applications that use fast-uri to enforce host-based policy such as allowlists, denylists, loopback or SSRF filtering, redirect validation, or outbound proxy routing before passing the same URL into Node's URL or fetch consumers can be steered to an unintended destination, including cloud metadata endpoints, loopback, or internal hosts.
Patches: upgrade to fast-uri 4.1.1, 3.1.4, or 2.4.3.
Workarounds: none.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| fast-uri | fast-uri | 2.3.1 – < 2.4.3, 3.0.0 – < 3.1.4, 4.0.0 – < 4.1.1 | 2.4.3 |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | node-ajv | 8.20.0~ds+~cs7.1.2-1 | — |
| Debian 13 | node-ajv | No fix yet | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 26.10 | node-ajv | No fix yet | — |
| Ubuntu 26.04 LTS | node-ajv | No fix yet | — |
| Ubuntu 24.04 LTS | node-ajv | No fix yet | — |
| Ubuntu 22.04 LTS | node-ajv | No fix yet | — |
| Ubuntu 20.04 LTS | node-ajv | No fix yet | — |
Show 1 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 18.04 LTS | node-ajv | No fix yet | — |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat Hardened Images 1 | grafana12.4 | 12.4.8-0.1.1.hum1 | RHSA-2026:54518 |
| Red Hat Hardened Images 1 | grafana13.1 | 13.1.3-0.1.1.hum1 | RHSA-2026:54517 |
Wolfi
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Wolfi rolling | argo-workflows-ui-4.0 | 4.0.8-r0 | — |
| Wolfi rolling | jupyter-base-notebook | 7.6.3-r2 | — |
| Wolfi rolling | langfuse-3 +1 | 3.224.1-r0 | — |
| Wolfi rolling | langfuse-3-compat | 3.225.7-r6 | — |
| Wolfi rolling | opensearch-dashboards-3 | 3.7.0-r11 | — |
| Wolfi rolling | opensearch-dashboards-3-dashboards-maps +11 | 3.7.0-r7 | — |
| Wolfi rolling | prism | 5.16.0-r4 | — |
| Wolfi rolling | renovate | 44.3.2-r0 | — |
| Wolfi rolling | tileserver-gl | 5.6.0-r10 | — |
| Wolfi rolling | vitess-24 | 24.0.2-r7 | — |
| Wolfi rolling | vitess-24-compat | 24.0.3-r7 | — |
| Wolfi rolling | yaml-language-server | 1.24.0-r1 | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| npm | fast-uri | >= 2.3.1, < 2.4.3 | 2.4.3 | GHSA-v2hh-gcrm-f6hx |
| npm | fast-uri | >= 3.0.0, < 3.1.4 | 3.1.4 | GHSA-v2hh-gcrm-f6hx |
| npm | fast-uri | >= 4.0.0, < 4.1.1 | 4.1.1 | GHSA-v2hh-gcrm-f6hx |
Advisories 5
- WID-SEC-2026-3376 Atlassian Bamboo, Bitbucket, Confluence, Fisheye/Crucible, Jira Software und Jira Service Management: Mehrere Schwachstellen BSI CERT-Bund (WID) · Nov 10, 2026
- WID-SEC-2026-2923 Atlassian Produkte (Bamboo, Bitbucket, Confluence, Crucible, Fisheye, und Jira): Mehrere Schwachstellen BSI CERT-Bund (WID) · Nov 8, 2026
- RHSA-2026:54517 Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update Red Hat Security Advisories (RHSA) · Oct 20, 2026
- RHSA-2026:54518 Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update Red Hat Security Advisories (RHSA) · Oct 20, 2026
- NCSC-2026-0325 Kwetsbaarheden verholpen in Atlassian producten NCSC-NL (Netherlands) · Aug 24, 2026