Riskcovery

CVE-2026-16221

fast-uri vulnerable to host confusion via literal backslash authority delimiter

State
Published
Severity
7.5 High
Published
Jul 19, 2026
Updated
Jul 20, 2026
Reserved
Jul 18, 2026

Read the record on cve.org

Description

Impact: fast-uri versions from 2.3.1 through 4.1.0 (including the 3.x line up to 3.1.3 and the 2.x line up to 2.4.2) do not treat a literal backslash character (U+005C) as an authority delimiter. Node's native WHATWG URL parser, used by fetch, undici, and Node's http and https clients, normalizes the backslash to a forward slash for special schemes such as http, https, ws, wss, ftp, and file. As a result, the two parsers extract different hosts from the same input string. Applications that use fast-uri to enforce host-based policy such as allowlists, denylists, loopback or SSRF filtering, redirect validation, or outbound proxy routing before passing the same URL into Node's URL or fetch consumers can be steered to an unintended destination, including cloud metadata endpoints, loopback, or internal hosts.

Patches: upgrade to fast-uri 4.1.1, 3.1.4, or 2.4.3.

Workarounds: none.

Scores

CVSSScoreVectorSource
3.17.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:Nopenjs

Weaknesses

Affected Products

ProductVersions
fast-urifast-uri
  • 2.3.1 to before 2.4.3Affected
  • 2.4.3Not affected
  • 3.0.0 to before 3.1.4Affected
  • 3.1.4Not affected
  • 4.0.0 to before 4.1.1Affected
  • 4.1.1Not affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.