fast-uri vulnerable to host confusion via literal backslash authority delimiter

🗓️ 21 Jul 2026 22:08:28Reported by GitHub Advisory DatabaseType

fast-uri before 4.1.1 misparses host with literal backslash, causing policy desync with Node URL.

Reporter	Title	Published	Views	Family All 54
IBM Security Bulletins	Security Bulletin: Multiple vulnerabilities in IBM Aspera Faspex	11 Aug 202618:25	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple vulnerabilities found in IBM ApplinX.	10 Aug 202605:25	–	ibm
Chainguard	CVE-2026-16221 vulnerabilities	23 Jul 202608:23	–	cgr
Circl	CVE-2026-16221	19 Jul 202614:22	–	circl
CVE	CVE-2026-16221	19 Jul 202614:08	–	cve
Cvelist	CVE-2026-16221 fast-uri vulnerable to host confusion via literal backslash authority delimiter	19 Jul 202614:08	–	cvelist
Debian CVE	CVE-2026-16221	19 Jul 202614:08	–	debiancve
EUVD	EUVD-2026-45551	21 Jul 202622:08	–	euvd
NVD	CVE-2026-16221	19 Jul 202615:16	–	nvd
OSV	CGA-V6H3-F8JX-F899	23 Jul 202600:25	–	osv

Vulners

Node

openjsf fast-uriRange4.0.0–4.1.0npm

openjsf fast-uriRange3.0.0–3.1.3npm

openjsf fast-uriRange2.3.1–2.4.2npm

Source	Link
github	www.github.com/fastify/fast-uri/security/advisories/GHSA-v2hh-gcrm-f6hx
nvd	www.nvd.nist.gov/vuln/detail/CVE-2026-16221
github	www.github.com/fastify/fast-uri/commit/0542a216860fd70c062a4730e620576f62ded057
github	www.github.com/fastify/fast-uri/commit/2d50fbabc80e4d0884fe0f6a98fe118ce6faa353
github	www.github.com/fastify/fast-uri/commit/9438266d6a7ded688c8bc7c4ba506da17f44a17b
cna	www.cna.openjsf.org/security-advisories.html
github	www.github.com/fastify/fast-uri/releases/tag/v2.4.3
github	www.github.com/fastify/fast-uri/releases/tag/v3.1.4
github	www.github.com/fastify/fast-uri/releases/tag/v4.1.1
github	www.github.com/advisories/GHSA-v2hh-gcrm-f6hx

21 Jul 2026 22:08Current

5.3Medium risk

Vulners AI Score5.3

CVSS 3.17.5

EPSS0.00254

SSVC