EUVD-2026-45551Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
AC:H because exploitation needs the specific fast-uri-check-then-Node-fetch pattern; PR:N/UI:N as attacker-supplied URLs suffice; C:H reflects SSRF to metadata/internal resources over I:N.
Primary rating from Vendor (openjs).
CVSS VectorVendor: openjs
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Lifecycle Timeline
3DescriptionCVE.org
Impact: fast-uri versions from 2.3.1 through 4.1.0 (including the 3.x line up to 3.1.3 and the 2.x line up to 2.4.2) do not treat a literal backslash character (U+005C) as an authority delimiter. Node's native WHATWG URL parser, used by fetch, undici, and Node's http and https clients, normalizes the backslash to a forward slash for special schemes such as http, https, ws, wss, ftp, and file. As a result, the two parsers extract different hosts from the same input string. Applications that use fast-uri to enforce host-based policy such as allowlists, denylists, loopback or SSRF filtering, redirect validation, or outbound proxy routing before passing the same URL into Node's URL or fetch consumers can be steered to an unintended destination, including cloud metadata endpoints, loopback, or internal hosts.
Patches: upgrade to fast-uri 4.1.1, 3.1.4, or 2.4.3.
Workarounds: none.
AnalysisAI
Host-based policy bypass in the fast-uri Node.js URI parser (versions 2.3.1 through 4.1.0, spanning the 2.x line up to 2.4.2 and the 3.x line up to 3.1.3) allows remote attackers to smuggle a different host past allowlist, denylist, SSRF, loopback, and redirect-validation checks by using a literal backslash. Because fast-uri does not treat U+005C as an authority delimiter while Node's native WHATWG URL parser (used by fetch, undici, and the http/https clients) normalizes backslash to forward slash for special schemes, the two parsers disagree on the host, enabling requests to be steered to cloud metadata, loopback, or internal endpoints. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires that the target application (1) uses fast-uri at an affected version (2.3.1-4.1.0) to parse or extract the host from an attacker-influenced URL, (2) makes a security decision on that host - allowlist, denylist, loopback/SSRF filter, redirect validation, or outbound proxy routing - and (3) then passes the SAME raw URL string into a Node consumer backed by the WHATWG URL parser (fetch, undici, http, or https clients) for the actual request. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The published CVSS 3.1 vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N yields 7.5 (High), modeling an unauthenticated network attacker who bypasses integrity-relevant host controls. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker submits a URL such as http:\\attacker-controlled\@169.254.169.254/ (or similar backslash-laden authority) to a Node application that validates the host with fast-uri and then fetches it via undici/fetch. fast-uri parses one host and approves it against the allowlist while Node's parser normalizes the backslash and connects to a different host - the cloud metadata endpoint - returning IAM credentials to the attacker. … |
| Remediation | Vendor-released patch: upgrade fast-uri to 4.1.1 (4.x line), 3.1.4 (3.x line), or 2.4.3 (2.x line) depending on the major version you run; these releases make fast-uri treat a literal backslash consistently so its host extraction aligns with Node's WHATWG parser. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all applications using fast-uri versions 2.3.1 through 4.1.0 and flag those using it for host validation, SSRF prevention, or redirect checking as critical. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Path normalization bypass in fast-uri 3.1.0 and earlier allows remote attackers to circumvent path-based access controls
Authority confusion in fast-uri JavaScript library allows remote attackers to bypass URL validation security controls. T
Host-based security policy bypass in the fast-uri Node.js URI parser (versions 2.3.1 through 3.1.2 and 4.0.0) lets remot
Same weakness CWE-436 – Interpretation Conflict
View allShare
External POC / Exploit Code
Leaving vuln.today