CVE-2026-16221

Impact: fast-uri versions from 2.3.1 through 4.1.0 (including the 3.x line up to 3.1.3 and the 2.x line up to 2.4.2) do not treat a literal backslash character (U+005C) as an authority delimiter. Node's native WHATWG URL parser, used by fetch, undici, and Node's http and https clients, normalizes the backslash to a forward slash for special schemes such as http, https, ws, wss, ftp, and file. As a result, the two parsers extract different hosts from the same input string. Applications that use fast-uri to enforce host-based policy such as allowlists, denylists, loopback or SSRF filtering, redirect validation, or outbound proxy routing before passing the same URL into Node's URL or fetch consumers can be steered to an unintended destination, including cloud metadata endpoints, loopback, or internal hosts. Patches: upgrade to fast-uri 4.1.1, 3.1.4, or 2.4.3. Workarounds: none.

Scoring

Severity

HIGH

CVSS base score

7.5

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

EPSS probability

0.44%

CWE

CWE-436

Published

2026-07-19

Last modified

2026-07-20

Affected products

• fast-uri fast-uri
• fast-uri fast-uri
• fast-uri fast-uri
• fast-uri fast-uri
• fast-uri fast-uri
• fast-uri fast-uri

Weakness type

• CWE-436

Related vulnerabilities

• CVE-2026-87627 — Interpretation conflict in Safebrowsing in Google Chrome on on Mac prior to 153.0.8010.36 allowed a...
• CVE-2026-82537 — Roo-Code 3.54.0 Auto-Approve Bypass via Shell Parser Word-Boundary Mismatch
• CVE-2026-81378 — Visual Studio Code Security Feature Bypass Vulnerability
• CVE-2026-85184 — @fastify/middie vulnerable to path-scoped middleware bypass via absolute-form request target
• CVE-2026-84394 — fast-uri vulnerable to host confusion via an unclosed bracket in the URI authority
• CVE-2026-63435 — Mail: Email address spoofing via malformed RFC 2047 encoded-words
• CVE-2026-75931 — fast-uri vulnerable to host confusion via skipped IDN canonicalization on scheme-relative references
• CVE-2026-57580 — authentik: Account Takeover via SAML NameID Comment Truncation

Markdown version · Browse all CVEs