The vulnerability CVE-2026-18446 affects the fast-uri library by incorrectly parsing Uniform Resource Identifiers (URIs) when a backslash is used in place of a forward slash to introduce the authority component. This parsing discrepancy compared to Node.js's native WHATWG URL parser can cause host confusion, enabling attackers to bypass security policies like allowlists or Server-Side Request Forgery (SSRF) filters. This can lead to redirection of applications to arbitrary external hosts. The issue affects Red Hat Hardened Images RPMs, specifically grafana12.4 and related packages. Red Hat has issued security updates to fix this vulnerability.

The vulnerability allows remote attackers to bypass host-based security policies, including allowlists and SSRF filters, by exploiting the URI parsing discrepancy. This can result in applications being redirected to unintended or malicious hosts, potentially leading to unauthorized access or data exposure. The impact is rated high by Red Hat due to the integrity impact of such bypasses.

A patch is available from Red Hat as updated RPM packages for the affected components, including grafana12.4-12.4.6-0.3.hum1. Users should apply these updates promptly to remediate the vulnerability. No effective mitigations other than applying the official fix are currently recommended by Red Hat, as alternative mitigations do not meet their criteria for ease of use, applicability, or stability.