CVE-2026-16221
HighCVSS 7.5Exploitation Probability (EPSS)
Low risk13th percentile - higher than 13% of all known CVEs
Summary
Vulnerability in fast-uri library (versions 2.3.1-4.1.0, 3.x up to 3.1.3, 2.x up to 2.4.2). Backslash is not treated as an authority delimiter, while Node's parser normalizes it to slash. Parsing discrepancy can bypass host-based policies (allowlists, SSRF filtering).
Risk Assessment
Risk of routing traffic to unauthorized hosts, including cloud metadata endpoints, loopback, or internal servers, potentially leading to data leakage or privilege escalation.
Recommendation
Upgrade fast-uri to version 4.1.1, 3.1.4, or 2.4.3. No workaround.
Other vulnerabilities in fast-uri
See all- CVE-2026-76172High
The fast-uri URI parser for Node.js mishandles schemes with percent-encoded slashes, allowing an attacker to manipulate the host and bypass allowlists. Affected versions are 2.3.1 up to 2.4.4, 3.0.0 up to 3.1.5, and 4.0.0 up to 4.1.2.
- CVE-2026-75975High
The fast-uri URI parser for Node.js incorrectly validates bracketed IPv6 literals, allowing a malicious host to be transformed into a different IPv6 destination, such as loopback or private address. Affected versions are 2.3.1 up to 2.4.4, 3.0.0 up to 3.1.5, and 4.0.0 up to 4.1.2.
- CVE-2026-75931High
The fast-uri URI parser for Node.js does not canonicalize the host in scheme-relative references, leading to inconsistencies between parse, resolve, normalize, and equal functions. Affected versions are 2.4.2 up to 2.4.4, 3.1.3 up to 3.1.5, and 4.0.1 up to 4.1.2.
- CVE-2026-75899High
The fast-uri URI parser for Node.js decodes percent escapes in the hostname twice, potentially changing the destination to loopback or another internal address. Affected versions are 2.4.1 up to 2.4.4, 3.1.2 up to 3.1.5, and 4.0.0 up to 4.1.2.
- CVE-2026-18446High
The fast-uri library before versions 4.1.2, 3.1.5, and 2.4.4 incorrectly parses URIs when a backslash is used instead of a double forward slash. Node.js treats backslash as interchangeable with forward slash, leading to differences in host parsing. Applications using fast-uri for host-based policy enforcement can be steered to an unintended host.
- CVE-2026-13676High
fast-uri versions 2.3.1 through 3.1.2 and 4.0.0 fail to canonicalize Unicode (IDN) hostnames for HTTP-family URLs. This causes discrepancies between fast-uri and Node's native URL parser, potentially bypassing host-based policies.
- CVE-2026-6322High
In fast-uri versions up to 3.1.1, the normalize() function decoded percent-encoded authority delimiters inside the host component and re-emitted them as raw delimiters during serialization. This allows an attacker to change the URI authority to a different domain than the input appeared to specify.
- CVE-2026-6321High
In the fast-uri library, the normalize() and equal() functions decoded percent-encoded path separators and dot segments before applying dot-segment removal. Encoded path data was treated as real slashes and parent-directory references, causing distinct URIs to collapse onto the same normalized path. Versions up to 3.1.0 are affected.
Original NVD description (English source)
Impact: fast-uri versions from 2.3.1 through 4.1.0 (including the 3.x line up to 3.1.3 and the 2.x line up to 2.4.2) do not treat a literal backslash character (U+005C) as an authority delimiter. Node's native WHATWG URL parser, used by fetch, undici, and Node's http and https clients, normalizes the backslash to a forward slash for special schemes such as http, https, ws, wss, ftp, and file. As a result, the two parsers extract different hosts from the same input string. Applications that use fast-uri to enforce host-based policy such as allowlists, denylists, loopback or SSRF filtering, redirect validation, or outbound proxy routing before passing the same URL into Node's URL or fetch consumers can be steered to an unintended destination, including cloud metadata endpoints, loopback, or internal hosts. Patches: upgrade to fast-uri 4.1.1, 3.1.4, or 2.4.3. Workarounds: none.