fast-uri vulnerable to host confusion via literal backslash authority delimiter

🗓️ 21 Jul 2026 22:08:28Reported by GitHub Advisory DatabaseType

fast-uri before 4.1.1 misparses host with literal backslash, causing policy desync with Node URL.

Reporter	Title	Published	Views	Family All 86
IBM Security Bulletins	Security Bulletin: Security vulnerability has been found in IBM Verify Identity Access Digital Credentials (CVE-2026-16221)	13 Aug 202607:30	–	ibm
IBM Security Bulletins	Security Bulletin: IBM App Connect Enterprise Certified Container operator and operands are vulnerable to loss of confidentiality and denial of service due to multiple CVEs	12 Aug 202613:52	–	ibm
IBM Security Bulletins	Security Bulletin: There are vulnerabilities in IBM Maximo Manage application in IBM Maximo Application Suite	28 Aug 202605:59	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple vulnerabilities in IBM Aspera Faspex	11 Aug 202618:25	–	ibm
IBM Security Bulletins	Security Bulletin: IBM App Connect Enterprise is vulnerable to an Interpretation Conflict due to Node.js module fast-uri (CVE-2026-16221)	31 Aug 202608:46	–	ibm
IBM Security Bulletins	Security Bulletin: Vulnerability in fast-uri affects IBM watsonx Assistant Cartridge and IBM watsonx Orchestrate with watsonx Assistant Cartridge.	25 Aug 202618:05	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Quantum Safe Explorer is affected by multiple vulnerabilities	13 Aug 202610:19	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple vulnerabilities found in IBM ApplinX.	10 Aug 202605:25	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple vulnerabilities in IBM DevOps Solution Workbench	13 Aug 202607:26	–	ibm
IBM Security Bulletins	Security Bulletin: Platform Navigator and Automation Assets in IBM Cloud Pak for Integration are vulnerable to a vulnerability in fast-uri	24 Aug 202611:42	–	ibm

Vulners

Node

openjsf fast-uriRange4.0.0–4.1.0npm

openjsf fast-uriRange3.0.0–3.1.3npm

openjsf fast-uriRange2.3.1–2.4.2npm

Source	Link
github	www.github.com/fastify/fast-uri/security/advisories/GHSA-v2hh-gcrm-f6hx
nvd	www.nvd.nist.gov/vuln/detail/CVE-2026-16221
github	www.github.com/fastify/fast-uri/commit/0542a216860fd70c062a4730e620576f62ded057
github	www.github.com/fastify/fast-uri/commit/2d50fbabc80e4d0884fe0f6a98fe118ce6faa353
github	www.github.com/fastify/fast-uri/commit/9438266d6a7ded688c8bc7c4ba506da17f44a17b
cna	www.cna.openjsf.org/security-advisories.html
github	www.github.com/fastify/fast-uri/releases/tag/v2.4.3
github	www.github.com/fastify/fast-uri/releases/tag/v3.1.4
github	www.github.com/fastify/fast-uri/releases/tag/v4.1.1
github	www.github.com/advisories/GHSA-v2hh-gcrm-f6hx

21 Jul 2026 22:08Current

5.3Medium risk

Vulners AI Score5.3

CVSS 3.17.5

EPSS0.00436

SSVC

CWE-436