CVE-2026-16221: fast-uri vulnerable to host confusion via literal backslash authority delimiter
Impact
fast-uri v4.1.0 and earlier do not treat a literal backslash (U+005C) as an authority delimiter. Node's native WHATWG URL (used by fetch(), undici, and Node's http/https clients) normalizes \ to / for special schemes (http, https, ws, wss, ftp, file), so the two parsers extract different hosts from the same input string.
For example, http://evil.com\@allowed.com is treated by fast-uri as host allowed.com with userinfo evil.com\, while Node's WHATWG URL parser and fetch() see host evil.com with path /@allowed.com.
Applications that use fast-uri to enforce host-based policy (allowlists, denylists, loopback/SSRF filtering, redirect validation, outbound proxy routing) before passing the same URL into Node's URL or fetch() consumers see a policy/use desync and can be steered to an unintended destination, including cloud metadata endpoints, loopback, or internal hosts.
Patches
Upgrade to fast-uri v4.1.1, v3.1.4, or v2.4.3.
Workarounds
None. Upgrade to the patched version.
Other sources
Impact: fast-uri versions from 2.3.1 through 4.1.0 (including the 3.x line up to 3.1.3 and the 2.x line up to 2.4.2) do not treat a literal backslash character (U+005C) as an authority delimiter. Node's native WHATWG URL parser, used by fetch, undici, and Node's http and https clients, normalizes the backslash to a forward slash for special schemes such as http, https, ws, wss, ftp, and file. As a result, the two parsers extract different hosts from the same input string. Applications that use fast-uri to enforce host-based policy such as allowlists, denylists, loopback or SSRF filtering, redirect validation, or outbound proxy routing before passing the same URL into Node's URL or fetch consumers can be steered to an unintended destination, including cloud metadata endpoints, loopback, or internal hosts.
Patches: upgrade to fast-uri 4.1.1, 3.1.4, or 2.4.3.
Workarounds: none.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
npm/fast-urito a version that resolves this vulnerability.Fixed in 4.1.1 - Upgrade
Upgrade
npm/fast-urito a version that resolves this vulnerability.Fixed in 3.1.4 - Upgrade
Upgrade
npm/fast-urito a version that resolves this vulnerability.Fixed in 2.4.3 - Upgrade
Upgrade
fast-urito a version that resolves this vulnerability.Fixed in 4.1.1 - Upgrade
Upgrade
fast-urito a version that resolves this vulnerability.Fixed in 3.1.4 - Upgrade
Upgrade
fast-urito a version that resolves this vulnerability.Fixed in 2.4.3
Event History
Frequently Asked Questions
What is the severity of CVE-2026-16221?
CVE-2026-16221 has a high severity rating of 7.5.
How does CVE-2026-16221 affect fast-uri?
CVE-2026-16221 affects fast-uri by allowing host confusion due to not treating a literal backslash as an authority delimiter.
Which versions of fast-uri are vulnerable to CVE-2026-16221?
Versions of fast-uri from 2.3.1 through 4.1.0, including 3.x up to 3.1.3 and 2.x up to 2.4.2, are vulnerable to CVE-2026-16221.
What is the impact of CVE-2026-16221?
The impact of CVE-2026-16221 is that it can lead to Server-Side Request Forgery (SSRF) attacks due to the authority delimiter confusion.
How can I fix CVE-2026-16221?
To fix CVE-2026-16221, you should update to a version of fast-uri that has patched this vulnerability.