CVE-2026-16221

Impact: fast-uri versions from 2.3.1 through 4.1.0 including the 3.x line up to 3.1.3 and the 2.x line up to 2.4.2 do not treat a literal backslash character U+005C as an authority delimiter. Node's native WHATWG URL parser, used by fetch, undici, and Node's http and https clients, normalizes the...

PT-2020-2776 · Openjpeg +6 · Openjpeg +6

Name of the Vulnerable Software and Affected Versions: OpenJPEG versions 2.3.1 through 2020-01-28 Description: The issue is related to a heap-based buffer overflow in the opj t1 clbl decode processor function of the OpenJPEG library, specifically in the openjp2/t1.c file when qmfbid==1. This can ...