Skip to content
Threat Feed
Subscribe

Product

Fast-Uri >= 3.0.0, <= 3.1.3

1 brief RSS
high advisory

Fast-uri Library Host Confusion Vulnerability (CVE-2026-16221)

The `fast-uri` library, in versions prior to 4.1.1, 3.1.4, and 2.4.3, is vulnerable to a host confusion issue (CVE-2026-16221) due to its failure to treat a literal backslash as an authority delimiter, enabling attackers to bypass host-based security policies via Server-Side Request Forgery (SSRF) or unauthorized access to internal resources.

fast-uri <= 2.4.2 +2 host-confusion ssrf dependency-vulnerability node.js
1c