VDB
RHSA-2026:54518
RHSA-2026:54518
PUBLISHED
CVSS 7.400000095367432 HIGH
A flaw was found in fast-uri. This vulnerability arises because fast-uri does not correctly interpret backslash characters as authority delimiters in Uniform Resource Locators (URLs), unlike Node.js's native WHATWG URL parser. This discrepancy can cause applications that use fast-uri for security policy enforcement, such as allowlists or Server-Side Request Forgery (SSRF) filtering, to misidentify the intended host. Consequently, an attacker could bypass these security policies, potentially redirecting traffic to unintended internal or sensitive network destinations.
Risk Scores
CVSS 3.1
7.400000095367432
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Red Hat | grafana12-4-main@x86_64 as a component of Red Hat Hardened Images | * |
| Red Hat | grafana12-4-main@src as a component of Red Hat Hardened Images | * |
| Red Hat | grafana12-4-main@aarch64 as a component of Red Hat Hardened Images | * |
Timeline
- Aug 13, 2026 CVE Published
- Aug 25, 2026 CVE Updated
- Aug 25, 2026 Distribution Patch
- Aug 25, 2026 Distribution Patch
- Aug 25, 2026 Security Advisory
- Aug 25, 2026 Security Advisory
- Aug 25, 2026 Security Advisory
- Aug 25, 2026 Security Advisory
- Aug 25, 2026 Security Advisory
- Aug 25, 2026 Security Advisory
References
- https://access.redhat.com/errata/RHSA-2026:54518 advisory
- https://access.redhat.com/security/cve/CVE-2026-73086 advisory
- https://access.redhat.com/security/cve/CVE-2026-73088 advisory
- https://access.redhat.com/security/cve/CVE-2026-73089 advisory
- https://access.redhat.com/security/updates/classification/ advisory
- https://images.redhat.com/ advisory
- https://access.redhat.com/security/cve/CVE-2026-45819 advisory
- https://access.redhat.com/security/cve/CVE-2026-16221 advisory
- https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_54518.json advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2502307 issue
- https://www.cve.org/CVERecord?id=CVE-2026-16221 advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-16221 advisory
- https://cna.openjsf.org/security-advisories.html advisory
- https://github.com/fastify/fast-uri/security/advisories/GHSA-v2hh-gcrm-f6hx advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2515240 issue
- https://www.cve.org/CVERecord?id=CVE-2026-45819 advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-45819 advisory
- https://github.com/web-platform-dx/baseline-browser-mapping/blob/b7881aa61c8a057e24468ab5ee18c5ecedbbf691/src/index.ts#L142 advisory
- https://github.com/web-platform-dx/baseline-browser-mapping/pull/137/changes#diff-7ae45ad102eab3b6d7e7896acd08c427a9b25b346470d7bc6507b6481575d519 advisory
- https://www.npmjs.com/package/baseline-browser-mapping advisory
…and 20 more