fast-uri vulnerable to host confusion via literal backslash authority delimiter
Impact
fast-uri v4.1.0 and earlier do not treat a literal backslash (U+005C) as an authority delimiter. Node's native WHATWG URL (used by fetch(), undici, and Node's http/https clients) normalizes \ to / for special schemes (http, https, ws, wss, ftp, file), so the two parsers extract different hosts from the same input string.
For example, http://evil.com\@allowed.com is treated by fast-uri as host allowed.com with userinfo evil.com\, while Node's WHATWG URL parser and fetch() see host evil.com with path /@allowed.com.
Applications that use fast-uri to enforce host-based policy (allowlists, denylists, loopback/SSRF filtering, redirect validation, outbound proxy routing) before passing the same URL into Node's URL or fetch() consumers see a policy/use desync and can be steered to an unintended destination, including cloud metadata endpoints, loopback, or internal hosts.
Patches
Upgrade to fast-uri v4.1.1, v3.1.4, or v2.4.3.
Workarounds
None. Upgrade to the patched version.
Affected software
Click a technology to see all vulnerabilities affecting it.
| Platform | Package | Vulnerable versions | Fixed in |
|---|---|---|---|
| npm package | fast-uri | >= 2.3.1, < 2.4.3, >= 3.0.0, < 3.1.4, >= 4.0.0, < 4.1.1 | 2.4.3, 3.1.4, 4.1.1 |
References
- https://github.com/fastify/fast-uri/security/advisories/GHSA-v2hh-gcrm-f6hx
- https://nvd.nist.gov/vuln/detail/CVE-2026-16221
- https://github.com/fastify/fast-uri/commit/0542a216860fd70c062a4730e620576f62ded057
- https://github.com/fastify/fast-uri/commit/2d50fbabc80e4d0884fe0f6a98fe118ce6faa353
- https://github.com/fastify/fast-uri/commit/9438266d6a7ded688c8bc7c4ba506da17f44a17b
- https://cna.openjsf.org/security-advisories.html
- https://github.com/fastify/fast-uri
- https://github.com/fastify/fast-uri/releases/tag/v2.4.3
- https://github.com/fastify/fast-uri/releases/tag/v3.1.4
- https://github.com/fastify/fast-uri/releases/tag/v4.1.1
- CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N- Weakness (CWE)
CWE-436- Platform
- npm
- Package
fast-uri- Disclosed
- 21.07.2026
- Updated
- 11.10.2026 10:22
Sources and licenses
OSV / GitHub Advisory Database - GHSA-v2hh-gcrm-f6hx - CC BY 4.0
Vulnerability history: fast-uri
All published vulnerabilities of this package (npm package), newest first. Shows whether this is a one-off slip or a package that needs watching.
- Total entries
- 13
- First → latest
- 05.2026 09.2026
- Without a fix
- 0
- Exploited in attacks
- 0
Severity breakdown
- High 11
- Medium 2
Disclosures per year
- 2026: 13
-
fast-uri vulnerable to host confusion via literal backslash authority delimiter this entry
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.