CVE-2026-16221
Received Received - Intake

fast-uri Backslash Authority Handling Bypass

Publication date: 2026-07-19

Last updated on: 2026-07-19

Assigner: openjs

Description
Impact: fast-uri versions from 2.3.1 through 4.1.0 (including the 3.x line up to 3.1.3 and the 2.x line up to 2.4.2) do not treat a literal backslash character (U+005C) as an authority delimiter. Node's native WHATWG URL parser, used by fetch, undici, and Node's http and https clients, normalizes the backslash to a forward slash for special schemes such as http, https, ws, wss, ftp, and file. As a result, the two parsers extract different hosts from the same input string. Applications that use fast-uri to enforce host-based policy such as allowlists, denylists, loopback or SSRF filtering, redirect validation, or outbound proxy routing before passing the same URL into Node's URL or fetch consumers can be steered to an unintended destination, including cloud metadata endpoints, loopback, or internal hosts. Patches: upgrade to fast-uri 4.1.1, 3.1.4, or 2.4.3. Workarounds: none.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-19
Last Modified
2026-07-19
Generated
2026-07-20
AI Q&A
2026-07-19
EPSS Evaluated
N/A
NVD
CVE-2026-16221
EUVD
EUVD-2026-45551

Affected Vendors & Products

Showing 6 associated CPEs
Vendor Product Version / Range
fast-uri fast-uri From 2.3.1 (inc) to 4.1.0 (inc)
fast-uri fast-uri to 3.1.3 (inc)
fast-uri fast-uri to 2.4.2 (inc)
fast-uri fast-uri 4.1.1
fast-uri fast-uri 3.1.4
fast-uri fast-uri 2.4.3

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-436 Product A handles inputs or steps differently than Product B, which causes A to perform incorrect actions based on its perception of B's state.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability affects fast-uri versions 2.3.1 through 4.1.0. It occurs because these versions do not treat a backslash as an authority delimiter. Node's URL parser converts backslashes to forward slashes, causing different hosts to be extracted from the same input string. Applications using fast-uri for host-based policies may be misled into connecting to unintended destinations.

Detection Guidance

Detecting this vulnerability requires checking the version of fast-uri in use. Run commands like 'npm list fast-uri' or 'yarn list fast-uri' in your project directory to identify installed versions. Compare the output against vulnerable versions (2.3.1 to 4.1.0, including 3.x up to 3.1.3 and 2.x up to 2.4.2).

Additionally, inspect your application's dependencies for fast-uri usage in package.json or package-lock.json files. Look for any references to versions within the vulnerable range.

Impact Analysis

This vulnerability can allow attackers to bypass host-based security controls like allowlists, denylists, or SSRF filtering. It may redirect applications to malicious cloud metadata endpoints, internal hosts, or loopback addresses, potentially leading to data breaches or unauthorized access.

Compliance Impact

This vulnerability could potentially impact compliance with GDPR and HIPAA by allowing unauthorized access to internal hosts or cloud metadata endpoints. Applications using fast-uri for host-based policy enforcement may be misled into routing requests to unintended destinations, violating data protection requirements.

Mitigation Strategies

Upgrade fast-uri to a patched version immediately: 4.1.1, 3.1.4, or 2.4.3. Use commands like 'npm update fast-uri' or 'yarn upgrade fast-uri' to apply the fix.

After updating, verify the new version is installed by running the detection commands again. Ensure no other dependencies rely on vulnerable versions of fast-uri.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-16221. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart