fast-uri vulnerable to host confusion via literal backslash authority delimiter

🗓️ 21 Jul 2026 22:08:28Reported by GitHub Advisory DatabaseType

fast-uri before 4.1.1 misparses host with literal backslash, causing policy desync with Node URL.

Reporter	Title	Published	Views	Family All 14
Circl	CVE-2026-16221	19 Jul 202614:22	–	circl
CVE	CVE-2026-16221	19 Jul 202614:08	–	cve
Cvelist	CVE-2026-16221 fast-uri vulnerable to host confusion via literal backslash authority delimiter	19 Jul 202614:08	–	cvelist
Debian CVE	CVE-2026-16221	19 Jul 202614:08	–	debiancve
EUVD	EUVD-2026-45551	21 Jul 202622:08	–	euvd
NVD	CVE-2026-16221	19 Jul 202615:16	–	nvd
OSV	DEBIAN-CVE-2026-16221	19 Jul 202615:16	–	osv
OSV	GHSA-V2HH-GCRM-F6HX fast-uri vulnerable to host confusion via literal backslash authority delimiter	21 Jul 202622:08	–	osv
OSV	UBUNTU-CVE-2026-16221	21 Jul 202600:00	–	osv
Patchstack	NPM: fast-uri vulnerable to host confusion via literal backslash authority delimiter	21 Jul 202622:08	–	patchstack

Vulners

Node

openjsf fast-uriRange4.0.0–4.1.0npm

openjsf fast-uriRange3.0.0–3.1.3npm

openjsf fast-uriRange2.3.1–2.4.2npm

Source	Link
github	www.github.com/fastify/fast-uri/security/advisories/GHSA-v2hh-gcrm-f6hx
nvd	www.nvd.nist.gov/vuln/detail/CVE-2026-16221
github	www.github.com/fastify/fast-uri/commit/0542a216860fd70c062a4730e620576f62ded057
github	www.github.com/fastify/fast-uri/commit/2d50fbabc80e4d0884fe0f6a98fe118ce6faa353
github	www.github.com/fastify/fast-uri/commit/9438266d6a7ded688c8bc7c4ba506da17f44a17b
cna	www.cna.openjsf.org/security-advisories.html
github	www.github.com/fastify/fast-uri/releases/tag/v2.4.3
github	www.github.com/fastify/fast-uri/releases/tag/v3.1.4
github	www.github.com/fastify/fast-uri/releases/tag/v4.1.1
github	www.github.com/advisories/GHSA-v2hh-gcrm-f6hx

21 Jul 2026 22:08Current

5.3Medium risk

Vulners AI Score5.3

CVSS 3.17.5

EPSS0.00221

SSVC