fast-uri before 4.1.2, 3.1.5, and 2.4.4 requires a literal double forward slash to recognize a URI authority, so a reference that uses a backslash based introdu…

CVE-2026-18446 affects the fast-uri Node.js library in versions before 4.1.2, 3.1.5, and 2.4.4. The library strictly requires a double forward slash to recognize a URI authority, while Node's native WHATWG URL parser treats backslashes as equivalent to forward slashes for special schemes. Attackers can craft URLs using backslash-based introducers (\\, /\, or \/) that fast-uri parses without an authority, while Node's parser resolves them to a different host. This discrepancy enables security bypass attacks against applications that use fast-uri for host-based policy enforcement such as allowlists, SSRF filtering, or redirect validation before passing URLs to Node's URL or fetch consumers. The vulnerability can lead to Server-Side Request Forgery (SSRF) or open redirect exploitation by steering requests to unintended hosts. The fix is to upgrade to fast-uri versions 4.1.2, 3.1.5, or 2.4.4.