VulnSocial

CVE-2026-16221Patch(openjsf / fast-uri)

LOWCVSS 7.5 · HIGH

Signal is active with 3 mentions in latest observed window

Immediate actions

  • Patch openjsf fast-uri systems immediately

Recommended action window: Monitor and triage in normal cycle

NVD description

Impact: fast-uri versions from 2.3.1 through 4.1.0 (including the 3.x line up to 3.1.3 and the 2.x line up to 2.4.2) do not treat a literal backslash character (U+005C) as an authority delimiter. Node's native WHATWG URL parser, used by fetch, undici, and Node's http and https clients, normalizes the backslash to a forward slash for special schemes such as http, https, ws, wss, ftp, and file. As a result, the two parsers extract different hosts from the same input string. Applications that use fast-uri to enforce host-based policy such as allowlists, denylists, loopback or SSRF filtering, redirect validation, or outbound proxy routing before passing the same URL into Node's URL or fetch consumers can be steered to an unintended destination, including cloud metadata endpoints, loopback, or internal hosts. Patches: upgrade to fast-uri 4.1.1, 3.1.4, or 2.4.3. Workarounds: none.

openjsf CVEsBack to dashboard
0.5/ 10 priority

Sources & remediation

Vendor / third-party advisories
Weakness type (CWE)
CWE-436

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

AVAILABLE

Momentum

NONE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

  • fast-uri

Threat summary

  • Patch or workaround signal is available
  • 3 mentions across 1 observed day

What's happening

  • Patch or workaround mentioned in 3 signals
  • Technical details provided in 3 signals
  • 3 total mentions across 1 day

Affected systems

Vendors
openjsf
Products
fast-uri

Deep dive

Activity timeline3 mentions / 1d
01223Mentions · 2026-07-19: 3Patch / Workaround · 2026-07-19: 3Technical Details · 2026-07-19: 307-19
Signal classification1 categories
Patch
3100.0%
Referenced assets1 URL
By indicator
Full discourse3 posts
  • Ulises Gascón@kom_256
    Patch

    🚨 High-severity security fix in fast-uri@4.1.1 (also 3.1.4 and 2.4.3 backports) just released! Patches CVE-2026-16221, host confusion via literal backslash authority delimiter. https://github.com/fastify/fast-uri/security/advisories/GHSA-v2hh-gcrm-f6hx

    Post summary

    The tweet announces a security fix for fast-uri that patches CVE‑2026‑16221, addressing a host confusion issue involving literal backslashes, and provides a link to a GitHub advisory.

    040811.0K
    5.5K followersView on X
  • Upwind Security MDR@UpwindMDR
    Patch

    🚨High - fast-uri Host Confusion Enables SSRF Filter Bypass (CVE-2026-16221) fast-uri, the Node.js URI parser used across the Fastify and Ajv ecosystems, does not treat a literal backslash (\) as an authority delimiter. Node's native WHATWG URL parser (fetch, undici, http/https) normalizes that backslash to a forward slash for schemes like http, https, ws, and file, so the two parsers extract different hosts from the same URL. Applications that validate host-based policy with fast-uri - allowlists, SSRF or loopback filtering, redirect validation, proxy routing - then hand the same URL to fetch or Node's URL can be steered to an unintended destination, including cloud metadata endpoints, loopback, or internal hosts. CVSS 7.5, no workaround. 👉Upgrade fast-uri to 4.1.1, 3.1.4, or 2.4.3 depending on your major version.

    Post summary

    The post discloses a SSRF bypass via host confusion in fast-uri and emphasizes the need to upgrade to patched versions.

    00000284
    254 followersView on X
  • DFIR Lab@DFIR_Lab
    Patch

    🚨 HIGH SEVERITY: CVE-2026-16221 (CVSS 7.5) fast-uri v2.3.1-4.1.0 fails to parse backslash as authority delimiter, enabling SSRF/allowlist bypass when used with Node's URL/fetch. Patch NOW to v4.1.1/3.1.4/2.4.3 #CVE #Vulnerability #PatchNow https://t.co/m9Q88doZhP

    Post summary

    The tweet announces a high‑severity SSRF/allowlist bypass vulnerability in fast‑uri, provides technical details, and urges users to update to the patched versions.

    0000039
    82 followersView on X
CPE platform detail1 entries

1 of 1 entries

PartVendorProductVersionTarget SWTarget HW
Appopenjsffast-uri-node.js-

Explore more

Back to dashboardopenjsf CVEsfast-uri vulnerabilities