Starlette reconstructs the requested URL based on the HTTP Host request header and requested path, but does not perform any validation of the Host header value. This allows attackers to inject paths into the host part, prepending the actual path. However, routing in Starlette is based on the actual request path. This inconsistent interpretation of HTTP requests may lead to issues such as authentication bypass when the authentication depends on the reconstructed URL’s path. Starlette is the foundation of the FastAPI Python framework.
Starlette is a lightweight, high-performance ASGI (Asynchronous Server Gateway Interface) framework and toolkit used for building asynchronous web services in Python. It is known for its speed, simplicity, and for being the foundation of popular frameworks like FastAPI.
When issuing an HTTP request for , clients extract the hostname example.com and the path /foo and issue the following request:
Starlette reconstructs the client’s original URL based on f"{scheme}://{host_header}{path}" , where {host_header} is the value of the Host request header and {path} is what was submitted in the first request line.
Starlette did not reject invalid characters in the Host header as per RFC 9112 Section 3.2 , and a request such as:
would result in the URL , which has a path of /abc while /foo was requested.
The routing algorithm of Starlette depends on the HTTP path, but the request.url.path attribute which is made available to middlewares and endpoints is based on the reconstructed URL. It is unexpected for users that request.url.path is different from the actual path requested over HTTP.
Using automated triage and analysis, X41 D-Sec has found several instances of middleware implementations in popular open source projects that rely on the request.url to apply security restrictions to certain paths. These could be bypassed using a malformed host request header, similar to the PoC attached below, resulting in various security issues ranging from authentication bypass to SSRF and other issues that in some cases even lead to remote-code-execution on the affected system.
Then, start the app using any of the ASGI servers:
Confirm that the Host header is not validated:
2026-01-27 Issue identified during unrelated source code audit
2026-02-04 PoC created and vendor contacted. GHSA-86qp-5c8j-p5mr
2026-02-05 Vendor replied
2026-03-01 Patch proposed by the vendor
2026-05-21 Patch publicly released by the vendor
2026-05-22 Advisory released
The full story
This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.
