VDB

RHSA-2026:49387

RHSA-2026:49387 PUBLISHED CVSS 6.5 MEDIUM

A flaw was found in fast-uri. This vulnerability arises because fast-uri incorrectly parses Uniform Resource Identifiers (URIs) when a backslash is used in place of a forward slash to introduce the authority component. This discrepancy with Node's native WHATWG URL parser can lead to host confusion. A remote attacker could exploit this to bypass security policies, such as allowlists or Server-Side Request Forgery (SSRF) filters, potentially redirecting applications to unintended hosts.

Risk Scores

CVSS 3.1
6.5
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N

Affected Products

VendorProductVersions
Red Hatgrafana13.1-0:13.1.1-0.4.hum1@aarch64 as a component of Red Hat Hardened Images13.1-0:13.1.1-0.4.hum1
Red Hatgrafana13.1-0:13.1.1-0.4.hum1@x86_64 as a component of Red Hat Hardened Images13.1-0:13.1.1-0.4.hum1
Red Hatgrafana13.1-0:13.1.1-0.4.hum1@src as a component of Red Hat Hardened Images13.1-0:13.1.1-0.4.hum1

Timeline

  • Aug 1, 2026 CVE Published
  • Oct 19, 2026 CVE Updated
  • Oct 19, 2026 Distribution Patch
  • Oct 19, 2026 Distribution Patch
  • Oct 19, 2026 Security Advisory
  • Oct 19, 2026 Security Advisory
  • Oct 19, 2026 Security Advisory

References

Open in Interactive Console →
$ Console Community · 50/day Open console ›