VDB
CVE-2026-110180
CVE-2026-110180
PUBLISHED
CVSS 4.800000190734863 MEDIUM
fast-uri vulnerable to host confusion via unchecked WHATWG host canonicalization
EPSS 0.26% · 17.1th percentile
Risk Scores
CVSS 3.1
4.800000190734863
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N
EPSS Score
0.26%
17.1th percentile
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| chainguard | opensearch-dashboards-3 | 0 |
| wolfi | serve | 0 |
| chainguard | supabase-storage-api | 0 |
| chainguard | vitess-24 | 0 |
| chainguard | wazuh-dashboard-fips | 0 |
| fast-uri | fast-uri | 4.2.3, 3.1.9, 2.4.2 |
| chainguard | unleash-proxy | 0 |
| wolfi | tileserver-gl | 0 |
| chainguard | opensearch-dashboards-3-fips | 0 |
| chainguard | wazuh-dashboard | 0 |
| chainguard | tileserver-gl-fips | 0 |
| chainguard | yaml-language-server | 0 |
| chainguard | verdaccio | 0 |
| npm | fast-uri | |
| chainguard | supabase-storage-api-fips | 0 |
| chainguard | arangodb-3.11 | 0 |
| chainguard | serve | 0 |
| npm | fast-uri | 3.1.3, 4.0.1, 2.4.2 |
| wolfi | opensearch-dashboards-3 | 0 |
| chainguard | tileserver-gl | 0 |
…and 1 more
Timeline
- Oct 20, 2026 EPSS Score
- Oct 20, 2026 Coalition ESS Score
- Oct 20, 2026 CVE Published
- Oct 23, 2026 CVE Updated
- Oct 25, 2026 EPSS Score
- Oct 29, 2026 EPSS Score
- Oct 30, 2026 Security Advisory
References
- https://nvd.nist.gov/vuln/detail/CVE-2026-110180 advisory
- https://github.com/advisories/GHSA-wjr9-j795-jxcr advisory
- https://github.com/fastify/fast-uri/security/advisories/GHSA-wjr9-j795-jxcr url
- https://github.com/fastify/fast-uri/commit/58c183d0b168ad87f98773266444ce1f6375803a patch
- https://github.com/fastify/fast-uri/commit/ddfc6a51122dfce0365655f04479fc3adb7f6b3c patch
- https://github.com/fastify/fast-uri/commit/f6d46dfeab025d0c440485f4ae29fa4f14707646 patch
- https://cna.openjsf.org/security-advisories.html url
- https://github.com/fastify/fast-uri/releases/tag/v2.4.8 url
- https://github.com/fastify/fast-uri/releases/tag/v3.1.9 url
- https://github.com/fastify/fast-uri/releases/tag/v4.2.3 url