CVE-2026-18446 (GHSA-7P8R-X3MC-P8W7)

--- a/index.js+++ b/index.js@@ -202,6 +202,10 @@ function serialize (cmpts, opts) {  const URI_PARSE = /^(?:([^#/:?]+):)?(?:\/\/((?:([^#/?@]*)@)?(\[[^#/?\]]+\]|[^#/:?]*)(?::(\d*))?))?([^#?]*)(?:\?([^#]*))?(?:#((?:.|[\n\r])*))?/u +// Captures the authority component (between "//" and the next "/", "?" or "#"),+// with or without a scheme prefix, for the literal-backslash rejection below.+const AUTHORITY_PREFIX = /^(?:[^#/:?]+:)?\/\/([^/?#]*)/+ /** * @param {import('./types/index').URIComponent} parsed * @param {RegExpMatchArray} matches@@ -248,6 +252,19 @@ function parseWithStatus (uri, opts) { } } + // A literal backslash (U+005C) is not a valid RFC 3986 URI character and is+ // not an authority delimiter. Reject it in the authority rather than+ // rewriting it: normalizing "\" -> "/" (WHATWG error recovery) could silently+ // change the resource identified by an otherwise-invalid input, and lets "\"+ // act as a host delimiter here while Node's native URL parses a different+ // host (SSRF / redirect / origin-allowlist bypass). Percent-encoded %5C is+ // untouched and remains valid encoded data.+ const authorityMatch = uri.match(AUTHORITY_PREFIX)+ if (authorityMatch !== null && authorityMatch[1].indexOf('\\') !== -1) {+ parsed.error = 'URI authority must not contain a literal backslash.'+ malformedAuthorityOrPort = true+ }+ const matches = uri.match(URI_PARSE)  if (matches) {

--- a/test/security.test.js+++ b/test/security.test.js@@ -159,3 +159,65 @@ test('parse canonicalises IDN / Unicode hosts to their ASCII form', (t) => { t.equal(parsed.host, expectedHost, `host canonicalised to ASCII: ${description}`) }) })++test('parse rejects a literal backslash in the authority as malformed (RFC 3986)', (t) => {+ // Regression for the host-confusion bypass: a literal "\" is invalid RFC 3986+ // syntax and must be flagged malformed, not silently rewritten. Otherwise "\"+ // acts as a host delimiter here while Node's native URL parses a different+ // host, defeating a host-based SSRF/redirect/origin allowlist.+ const cases = [+ 'http://evil.com\\@allowed.com',+ 'https://169.254.169.254\\@trusted.example.com',+ 'http://127.0.0.1\\@public.example.com',+ 'https://attacker.com\\@api.internal',+ 'http://a\\@b',+ 'ws://evil.com\\@allowed.com/chat',+ 'wss://evil.com\\@allowed.com/chat',+ 'http://evil.com\\%40allowed.com',+ '//evil.com\\@allowed.com'+ ]++ t.plan(cases.length)++ cases.forEach((input) => {+ t.equal(+ fastURI.parse(input).error,+ 'URI authority must not contain a literal backslash.',+ input+ )+ })+})++test('normalize does not canonicalize a literal-backslash URI into a different valid URL', (t) => {+ const cases = [+ 'http://evil.com\\@allowed.com',+ 'https://attacker.com\\@api.internal'+ ]++ t.plan(cases.length)++ cases.forEach((input) => {+ t.equal(fastURI.normalize(input), input, input)+ })+})++test('parse leaves percent-encoded %5C untouched as encoded data (not rejected)', (t) => {+ // Only the literal "\" byte is rejected; %5C stays valid encoded data and+ // does not diverge from the native URL parser, so it must not be flagged.+ const input = 'http://evil.com%[email protected]'+ const parsed = fastURI.parse(input)++ t.plan(2)+ t.notOk(parsed.error, '%5C is valid encoded data, not malformed')+ t.equal(parsed.host, new URL(input).hostname, '%5C host matches native URL (no divergence)')+})++test('parse does not reject a literal backslash in the query or fragment', (t) => {+ // The rejection is scoped to the authority/path (the host-confusion surface);+ // a backslash after "?"/"#" is normalized as encoded data as before.+ const parsed = fastURI.parse('http://host.example.com/?x=\\y#z\\w')++ t.plan(2)+ t.notOk(parsed.error, 'backslash in query/fragment does not mark the URI malformed')+ t.equal(parsed.host, 'host.example.com', 'host parsed normally')+})

--- a/index.js+++ b/index.js@@ -26,7 +26,12 @@ function normalize (uri, options) { */ function resolve (baseURI, relativeURI, options) { const schemelessOptions = options ? Object.assign({ scheme: 'null' }, options) : { scheme: 'null' }- const resolved = resolveComponent(parse(baseURI, schemelessOptions), parse(relativeURI, schemelessOptions), schemelessOptions, true)+ const { parsed: baseParsed, malformedAuthorityOrPort: baseMalformed } = parseWithStatus(baseURI, schemelessOptions)+ const { parsed: relativeParsed, malformedAuthorityOrPort: relativeMalformed } = parseWithStatus(relativeURI, schemelessOptions)+ if (baseMalformed || relativeMalformed) {+ throw new Error(baseParsed.error || relativeParsed.error || 'URI is malformed.')+ }+ const resolved = resolveComponent(baseParsed, relativeParsed, schemelessOptions, true) schemelessOptions.skipEscape = true return serialize(resolved, schemelessOptions) }@@ -206,6 +211,15 @@ const URI_PARSE = /^(?:([^#/:?]+):)?(?:\/\/((?:([^#/?@]*)@)?(\[[^#/?\]]+\]|[^#/: // with or without a scheme prefix, for the literal-backslash rejection below. const AUTHORITY_PREFIX = /^(?:[^#/:?]+:)?\/\/([^/?#]*)/ +// Captures the leading authority-introducer region after an optional scheme: a+// run of forward slashes, backslashes, and the characters the WHATWG URL parser+// removes before parsing (TAB U+0009, LF U+000A, CR U+000D). A valid introducer+// is exactly "//". Node treats "\" as "/" on special schemes and strips those+// characters first, so forms like "\\", "/\", "\/", "/<TAB>/", or a leading+// "<TAB>//" reach an authority in Node while fast-uri's URI_PARSE folds them into+// the path group (host confusion / SSRF / redirect bypass).+const AUTHORITY_INTRODUCER_REGION = /^(?:[^#/:?]+:)?([/\\\t\n\r]*)/+ /** * @param {import('./types/index').URIComponent} parsed * @param {RegExpMatchArray} matches@@ -265,6 +279,28 @@ function parseWithStatus (uri, opts) { malformedAuthorityOrPort = true } + // Reject a malformed or whitespace-smuggled authority introducer. fast-uri+ // only recognizes a literal "//"; anything else in the leading separator run+ // (a backslash, or a "//" that appears only after removing the TAB/LF/CR that+ // Node strips) means the authority fast-uri parses differs from the one Node's+ // URL resolves. Reject rather than rewrite, mirroring the literal-backslash+ // guard above. Percent-encoded forms (%5C, %09) are untouched, valid data.+ const introducerMatch = uri.match(AUTHORITY_INTRODUCER_REGION)+ if (introducerMatch !== null) {+ const region = introducerMatch[1]+ const normalizedRegion = region.replace(/[\t\n\r]/g, '')+ // Two or more leading separators introduce an authority.+ if (normalizedRegion.length >= 2) {+ if (normalizedRegion.slice(0, 2) !== '//') {+ parsed.error = parsed.error || 'URI authority must not contain a literal backslash.'+ malformedAuthorityOrPort = true+ } else if (region.length !== normalizedRegion.length) {+ parsed.error = parsed.error || 'URI authority introducer must not contain whitespace.'+ malformedAuthorityOrPort = true+ }+ }+ }+ const matches = uri.match(URI_PARSE)  if (matches) {

--- a/test/security.test.js+++ b/test/security.test.js@@ -221,3 +221,139 @@ test('parse does not reject a literal backslash in the query or fragment', (t) = t.notOk(parsed.error, 'backslash in query/fragment does not mark the URI malformed') t.equal(parsed.host, 'host.example.com', 'host parsed normally') })++test('parse rejects a malformed authority introducer (\\\\, /\\, \\/) in place of //', (t) => {+ // Regression: "\\", "/\\", "\\/" after the scheme colon are not valid authority+ // introducers. Node's URL treats "\\" as interchangeable with "/" on special+ // schemes, so "http:\\\\evil.com/path" would be parsed as host "evil.com" by+ // Node, but fast-uri must reject it as malformed to prevent SSRF/redirect bypass.+ const cases = [+ 'http:\\\\evil.com/path',+ 'http:/\\evil.com/path',+ 'http:\\/evil.com/path',+ 'ws:\\\\evil.com/chat',+ 'wss:\\\\evil.com/chat',+ 'ftp:\\\\evil.com/',+ '\\\\evil.com/path'+ ]++ t.plan(cases.length)++ cases.forEach((input) => {+ t.equal(+ fastURI.parse(input).error,+ 'URI authority must not contain a literal backslash.',+ input+ )+ })+})++test('normalize does not canonicalize a malformed-authority-introducer URI', (t) => {+ const cases = [+ 'http:\\\\evil.com/path',+ 'http:/\\evil.com/path'+ ]++ t.plan(cases.length)++ cases.forEach((input) => {+ t.equal(fastURI.normalize(input), input, input)+ })+})++test('equal returns false for malformed-authority-introducer URIs', (t) => {+ const pairs = [+ ['http:\\\\evil.com/path', 'http://evil.com/path'],+ ['http:/\\evil.com/path', 'http://evil.com/path']+ ]++ t.plan(pairs.length)++ pairs.forEach(([left, right]) => {+ t.equal(fastURI.equal(left, right), false, `${left} != ${right}`)+ })+})++test('resolve throws on malformed authority introducer', (t) => {+ // resolve() returns a plain string with no error field, so the only safe+ // behavior is to throw when either component has a malformed authority.+ const pairs = [+ ['https://allowed.com/', '\\\\evil.com/path'],+ ['\\\\evil.com/path', 'https://allowed.com/'],+ ['https://allowed.com/', 'http:/\\evil.com/path'],+ ['https://allowed.com/', 'http:\\/evil.com/path']+ ]++ t.plan(pairs.length)++ pairs.forEach(([base, rel]) => {+ t.throws(+ => fastURI.resolve(base, rel),+ /URI authority must not contain a literal backslash/,+ `${base} + ${rel}`+ )+ })+})++test('parse rejects a whitespace-split authority introducer (TAB, LF, CR)', (t) => {+ // The WHATWG URL parser removes TAB (U+0009), LF (U+000A) and CR (U+000D) from+ // the input before parsing, so a stripped character wedged into the introducer+ // ("/<TAB>\\", "/<TAB>/", or a leading "<TAB>//") reaches an authority in Node+ // while fast-uri would otherwise fold it into the path. These must be rejected+ // like the adjacent "\\", "/\\", "\\/" forms.+ const cases = [+ { input: '/\t\\evil.com/path', expectedError: 'URI authority must not contain a literal backslash.' },+ { input: '/\t/evil.com/path', expectedError: 'URI authority introducer must not contain whitespace.' },+ { input: '/\n\\evil.com/path', expectedError: 'URI authority must not contain a literal backslash.' },+ { input: '/\r\\evil.com/path', expectedError: 'URI authority must not contain a literal backslash.' },+ { input: '\t//evil.com/path', expectedError: 'URI authority introducer must not contain whitespace.' },+ { input: '\t/\\evil.com/path', expectedError: 'URI authority must not contain a literal backslash.' },+ { input: 'https:/\t/evil.com/path', expectedError: 'URI authority introducer must not contain whitespace.' }+ ]++ t.plan(cases.length)++ cases.forEach(({ input, expectedError }) => {+ t.equal(fastURI.parse(input).error, expectedError, JSON.stringify(input))+ })+})++test('resolve throws on a whitespace-split authority introducer', (t) => {+ const pairs = [+ ['https://allowed.com/', '/\t\\evil.com/path'],+ ['https://allowed.com/', '/\t/evil.com/path'],+ ['https://allowed.com/', '/\n\\evil.com/path'],+ ['/\t/evil.com/path', 'https://allowed.com/']+ ]++ t.plan(pairs.length)++ pairs.forEach(([base, rel]) => {+ t.throws(+ => fastURI.resolve(base, rel),+ /URI authority (must not contain a literal backslash|introducer must not contain whitespace)/,+ `${JSON.stringify(base)} + ${JSON.stringify(rel)}`+ )+ })