PT-2026-61153 · Npm · Fast-Uri

Mcollina + 2 · CVE-2026-16221 · Published 2026-07-19 · Updated 2026-07-19

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions fast-uri versions 2.3.1 through 4.1.0

Description The software fails to treat a literal backslash character (U+005C) as an authority delimiter. Because Node's native WHATWG URL parser normalizes backslashes to forward slashes for specific schemes such as http, https, ws, wss, ftp, and file, the two parsers may extract different hosts from the same input string. This discrepancy can be exploited in applications that use fast-uri to enforce host-based policies—such as allowlists, denylists, loopback or SSRF (Server-Side Request Forgery) filtering, redirect validation, or outbound proxy routing—before passing the URL to Node's URL or fetch consumers. This can lead to requests being steered to unintended destinations, including internal hosts, loopback addresses, or cloud metadata endpoints.

Recommendations Upgrade fast-uri versions 4.x to 4.1.1 Upgrade fast-uri versions 3.x to 3.1.4 Upgrade fast-uri versions 2.x to 2.4.3

Fix

Weakness Enumeration

CWE-436

Related Identifiers

CVE-2026-16221

Affected Products

Fast-Uri

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2026-16221 · Security Note
• https://github.com/fastify/fast-uri/security/advisories/GHSA-v2hh-gcrm-f6hx · Note
• https://twitter.com/DFIR_Lab/status/2078863814687076654 · Twitter Post
• https://cna.openjsf.org/security-advisories.html · Note
• https://twitter.com/kom_256/status/2078847832866308567 · Twitter Post
• https://twitter.com/UpwindMDR/status/2078875452907622718 · Twitter Post