CVE-2026-110180

A flaw was found in fast-uri. When processing web addresses, the host canonicalization mechanism can silently strip control characters or drop user information without verifying that the full host input was consumed. A remote attacker can exploit this parsing discrepancy by supplying a specially crafted address to bypass host-based security policies, such as domain blocklists, redirect validations, or proxy routing rules. As a result, applications may inadvertently direct network requests to unintended destinations.

This vulnerability is rated as Moderate severity because exploitation requires a specific application architecture where host-based access controls or redirection boundaries rely directly on fast-uri parsing of untrusted network input. Because successful manipulation only allows bypassing host filters or redirecting traffic rather than granting arbitrary code execution, the overall blast radius remains constrained. In Red Hat environments, the affected Node.js package is primarily distributed as an embedded dependency within web applications and plugins, meaning the risk is contingent upon whether the consuming service exposes URL canonicalization to external users.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.