GHSA-v2hh-gcrm-f6hx CVE-2026-16221
fast-uri vulnerable to host confusion via literal backslash authority delimiter
- Severity
- 7.5 / 10
- High · CVSS 3.1
- Exploit chance (EPSS)
- 0.44%
- Chance of exploitation in the next 30 days. Higher than 37.87% of scored vulnerabilities.
- Known exploited
- No
- Not in CISA's catalog
- Weakness
- CWE-436 Interpretation Conflict
- Fix
2.4.3- Upgrade fast-uri to this version or later
Description
Impact
fast-uri v4.1.0 and earlier do not treat a literal backslash (U+005C) as an authority delimiter. Node's native WHATWG URL (used by fetch(), undici, and Node's http/https clients) normalizes \ to / for special schemes (http, https, ws, wss, ftp, file), so the two parsers extract different hosts from the same input string.
For example, http://evil.com\@allowed.com is treated by fast-uri as host allowed.com with userinfo evil.com\, while Node's WHATWG URL parser and fetch() see host evil.com with path /@allowed.com.
Applications that use fast-uri to enforce host-based policy (allowlists, denylists, loopback/SSRF filtering, redirect validation, outbound proxy routing) before passing the same URL into Node's URL or fetch() consumers see a policy/use desync and can be steered to an unintended destination, including cloud metadata endpoints, loopback, or internal hosts.
Patches
Upgrade to fast-uri v4.1.1, v3.1.4, or v2.4.3.
Workarounds
None. Upgrade to the patched version.
Affected versions
npm
| Package | Vulnerable | Fixed in |
|---|---|---|
| fast-uri | >= 2.3.1, <= 2.4.2 |
No fix yet |
| fast-uri | >= 3.0.0, <= 3.1.3 |
No fix yet |
| fast-uri | >= 4.0.0, <= 4.1.0 |
No fix yet |
| fast-uri | >= 2.3.1, < 2.4.3 |
2.4.3 |
| fast-uri | >= 3.0.0, < 3.1.4 |
3.1.4 |
| fast-uri | >= 4.0.0, < 4.1.1 |
4.1.1 |
How to fix
Move to the fixed version or later with your package manager, update the lockfile, and run your tests. If the package only arrives through another dependency, upgrade that dependency first. If none of its releases pulls a fixed version yet, force the version with your package manager's override.
fast-uri npm → 2.4.3
- npm
npm install fast-uri@2.4.3- yarn
yarn add fast-uri@2.4.3- pnpm
pnpm add fast-uri@2.4.3
Severity breakdown
CVSS 3.1 7.5
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
- Attack vector
- Network
- Attack complexity
- Low
- Privileges required
- None
- User interaction
- None
- Scope
- Unchanged
- Confidentiality
- None
- Integrity
- High
- Availability
- None
Weakness
CWE-436: Interpretation Conflict
Product A handles inputs or steps differently than Product B, which causes A to perform incorrect actions based on its perception of B's state.
References
Advisories
Fixes and patches
Packages
Other links
Timeline
- Published
- Last updated by the source
- Latest EPSS score
Related advisories
| Advisory | Severity | Why it's related |
|---|---|---|
| GHSA-333x-w4r6-6crp fast-uri vulnerable to scheme injection via an unescaped first-segment colon in suffix references | Low | Also affects fast-uri |
| GHSA-w74x-v6f9-j3xg fast-uri vulnerable to URI scheme spoofing via percent-encoded scheme decoding | Medium | Also affects fast-uri |
| GHSA-wjr9-j795-jxcr fast-uri vulnerable to host confusion via unchecked WHATWG host canonicalization | Medium | Also affects fast-uri |
| GHSA-xhq7-xmqj-769h fast-uri vulnerable to improper path equivalence in relative reference normalization | Low | Also affects fast-uri |
| GHSA-jvvf-x445-j334 fast-uri vulnerable to mailto header injection via percent-encoded field-name desynchronization | Medium | Also affects fast-uri |
| GHSA-hrr3-gc8f-f4qj fast-uri vulnerable to inconsistent host case normalization via percent-encoded octets | Medium | Also affects fast-uri |
| GHSA-58mr-gqgx-xq4g fast-uri vulnerable to host confusion via an unclosed bracket in the URI authority | High | Also affects fast-uri |
| GHSA-qw65-cvwx-89v3 fast-uri vulnerable to authority injection via an unvalidated port in serialize | High | Also affects fast-uri |
Credits: UlisesGascon, mcollina, rampage0010
MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.
Check your repos with MergeHarbor