← Vulnerability feed

Vulnerability record · CVE-2026-16221 · published 19 July 2026

CVE-2026-16221: Openjsf fast-uri interpretation conflict vulnerability

Openjsf · Fast Uri

Impact: fast-uri versions from 2.3.1 through 4.1.0 (including the 3.x line up to 3.1.3 and the 2.x line up to 2.4.2) do not treat a literal backslash character (U+005C) as an authority delimiter. Node's native WHATWG URL parser, used by fetch, undici, and Node's http and https clients, normalizes the backslash to a forward slash for special schemes such as http, https, ws, wss, ftp, and file. As a result, the two parsers extract different hosts from the same input string. Applications that use fast-uri to enforce host-based policy such as allowlists, denylists, loopback or SSRF filtering, redirect validation, or outbound proxy routing before passing the same URL into Node's URL or fetch consumers can be steered to an unintended destination, including cloud metadata endpoints, loopback, or internal hosts. Patches: upgrade to fast-uri 4.1.1, 3.1.4, or 2.4.3. Workarounds: none.

7.5 CVSS 3.1 High EPSS 0.25% · top 84.8% CWE-436 · Interpretation conflict
7.5CVSS 3.1 base score
0.25%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
2References
5 Aug 2026Last modified by NVD

Description

Impact: fast-uri versions from 2.3.1 through 4.1.0 (including the 3.x line up to 3.1.3 and the 2.x line up to 2.4.2) do not treat a literal backslash character (U+005C) as an authority delimiter. Node's native WHATWG URL parser, used by fetch, undici, and Node's http and https clients, normalizes the backslash to a forward slash for special schemes such as http, https, ws, wss, ftp, and file. As a result, the two parsers extract different hosts from the same input string. Applications that use fast-uri to enforce host-based policy such as allowlists, denylists, loopback or SSRF filtering, redirect validation, or outbound proxy routing before passing the same URL into Node's URL or fetch consumers can be steered to an unintended destination, including cloud metadata endpoints, loopback, or internal hosts. Patches: upgrade to fast-uri 4.1.1, 3.1.4, or 2.4.3. Workarounds: none.

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
https://cna.openjsf.org/security-advisories.html Vendor Advisory
https://github.com/fastify/fast-uri/security/advisories/GHSA-v2hh-gcrm-f6hx Vendor Advisory

Track CVE-2026-16221 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

7.5CVE-2026-84394Openjsf fast-uri interpretation conflict vulnerabilityfast-uri accepts a host that contains an unbalanced or misplaced authority bracket without reporting an error. A host that starts with an opening bra…EPSS 0.38%7.5CVE-2026-84292Openjsf fast-uri vulnerabilityfast-uri serializes the port component of a URI without validating it. When recomposing the authority, the userinfo and host components are escaped b…EPSS 0.38%7.5CVE-2026-76172Openjsf fast-uri vulnerabilityfast-uri is a URI parser for Node.js. During parsing it runs a legacy decoding pass over the scheme component and never re-escapes the result, and se…EPSS 0.40%7.5CVE-2026-75931Openjsf fast-uri interpretation conflict vulnerabilityfast-uri is a URI parser for Node.js. It canonicalizes a host to its ASCII form only when the input carries an explicit scheme, so a scheme-relative …EPSS 0.40%7.5CVE-2026-75975Openjsf fast-uri improper input validation vulnerabilityfast-uri is a URI parser for Node.js. Its custom parser for bracketed IPv6 literals does not validate the complete IPv6 grammar, so invalid trailing …EPSS 0.38%7.5CVE-2026-75899Openjsf fast-uri server-side request forgery (ssrf) vulnerabilityfast-uri is a URI parser for Node.js. It decodes percent escapes in a hostname during parsing and then decodes the parsed hostname a second time duri…EPSS 0.38%7.5CVE-2026-18446Openjsf fast-uri interpretation conflict vulnerabilityfast-uri before 4.1.2, 3.1.5, and 2.4.4 requires a literal double forward slash to recognize a URI authority, so a reference that uses a backslash ba…EPSS 0.22%7.5CVE-2026-13676Openjsf fast-uri interpretation conflict vulnerabilityfast-uri versions 2.3.1 through 3.1.2 and 4.0.0 fail to canonicalize Unicode (IDN) hostnames for HTTP-family URLs. The IDN conversion path calls a he…EPSS 0.48%

Source: NIST National Vulnerability Database (record CVE-2026-16221), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.