{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","feed_url":"https://feed.craftedsignal.io/products/fast-uri--3.0.0--3.1.3/feed.json","home_page_url":"https://feed.craftedsignal.io/","items":[{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[{"cvss":7.5,"id":"CVE-2026-16221"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["fast-uri \u003c= 2.4.2","fast-uri \u003e= 3.0.0, \u003c= 3.1.3","fast-uri \u003e= 4.0.0, \u003c= 4.1.0"],"_cs_severities":["high"],"_cs_tags":["host-confusion","ssrf","dependency-vulnerability","node.js"],"_cs_type":"advisory","_cs_vendors":[],"content_html":"\u003cp\u003eA high-severity host confusion vulnerability, identified as CVE-2026-16221, exists in the \u003ccode\u003efast-uri\u003c/code\u003e library, affecting versions 4.1.0 and earlier, as well as specific ranges within the v2 (2.3.1 through 2.4.2) and v3 (3.0.0 through 3.1.3) branches. This vulnerability stems from a parsing discrepancy where \u003ccode\u003efast-uri\u003c/code\u003e does not recognize a literal backslash (U+005C) as an authority delimiter, unlike Node.js's native WHATWG \u003ccode\u003eURL\u003c/code\u003e parser (used by \u003ccode\u003efetch()\u003c/code\u003e, \u003ccode\u003eundici\u003c/code\u003e, and Node's \u003ccode\u003ehttp\u003c/code\u003e/\u003ccode\u003ehttps\u003c/code\u003e clients). This allows an attacker to craft URLs that, when initially validated by \u003ccode\u003efast-uri\u003c/code\u003e against host-based security policies (e.g., allowlists, denylists, SSRF filtering), appear benign, but are then reinterpreted by Node's URL consumers to point to an unintended, potentially malicious, destination. This disparity can lead to severe security bypasses, including Server-Side Request Forgery (SSRF) and unauthorized access to internal or cloud resources.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eAn attacker crafts a malicious URL containing a literal backslash (U+005C) within the host or authority segment for special schemes (e.g., \u003ccode\u003ehttp://evil.com\\internal.resource\u003c/code\u003e).\u003c/li\u003e\n\u003cli\u003eAn application receives this crafted URL and initially passes it to the vulnerable \u003ccode\u003efast-uri\u003c/code\u003e library for enforcement of host-based security policies (e.g., allowlists, denylists, SSRF filtering).\u003c/li\u003e\n\u003cli\u003eThe \u003ccode\u003efast-uri\u003c/code\u003e library incorrectly parses the URL, considering the backslash as part of the path or userinfo rather than an authority delimiter, leading the security policy check to pass based on a seemingly benign or allowed host.\u003c/li\u003e\n\u003cli\u003eThe application then takes the \u003cem\u003esame\u003c/em\u003e URL string and passes it to Node.js's native WHATWG \u003ccode\u003eURL\u003c/code\u003e parser, \u003ccode\u003efetch()\u003c/code\u003e, or \u003ccode\u003eundici\u003c/code\u003e for network requests.\u003c/li\u003e\n\u003cli\u003eNode.js's native URL parser, for special schemes like HTTP or HTTPS, normalizes the backslash (U+005C) to a forward slash (U+002F) and correctly identifies the true, potentially malicious, target host (e.g., \u003ccode\u003einternal.resource\u003c/code\u003e).\u003c/li\u003e\n\u003cli\u003eThe application proceeds to make a network request to the unintended and unvalidated destination, bypassing the intended security policy.\u003c/li\u003e\n\u003cli\u003eThis discrepancy between \u003ccode\u003efast-uri\u003c/code\u003e's parsing and Node's URL consumers results in a successful security policy bypass.\u003c/li\u003e\n\u003cli\u003eThe attacker achieves objectives such as Server-Side Request Forgery (SSRF), unauthorized access to internal network services, or data exfiltration from sensitive endpoints like cloud metadata services.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eThe successful exploitation of CVE-2026-16221 can lead to severe consequences for applications relying on \u003ccode\u003efast-uri\u003c/code\u003e for URL validation. If an application uses \u003ccode\u003efast-uri\u003c/code\u003e to enforce host-based policies (such as allowlists, denylists, or SSRF filtering) and then passes the same URL to Node.js's native URL or \u003ccode\u003efetch()\u003c/code\u003e clients, an attacker can bypass these controls. This can steer the application to unintended destinations, including internal network hosts, loopback addresses, or cloud metadata endpoints. This allows for Server-Side Request Forgery (SSRF), unauthorized access to sensitive internal systems or data, and potential data exfiltration. The vulnerability could impact a broad range of Node.js applications that process URLs from untrusted sources and utilize the \u003ccode\u003efast-uri\u003c/code\u003e library.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpgrade the \u003ccode\u003efast-uri\u003c/code\u003e library immediately to patched versions 4.1.1, 3.1.4, or 2.4.3 to remediate CVE-2026-16221.\u003c/li\u003e\n\u003cli\u003eEnsure that all applications using \u003ccode\u003efast-uri\u003c/code\u003e are updated to a non-vulnerable version to prevent host confusion and policy bypasses.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-07-21T22:14:18Z","date_published":"2026-07-21T22:14:18Z","id":"https://feed.craftedsignal.io/briefs/2026-07-fast-uri-host-confusion/","summary":"The `fast-uri` library, in versions prior to 4.1.1, 3.1.4, and 2.4.3, is vulnerable to a host confusion issue (CVE-2026-16221) due to its failure to treat a literal backslash as an authority delimiter, enabling attackers to bypass host-based security policies via Server-Side Request Forgery (SSRF) or unauthorized access to internal resources.","title":"Fast-uri Library Host Confusion Vulnerability (CVE-2026-16221)","url":"https://feed.craftedsignal.io/briefs/2026-07-fast-uri-host-confusion/"}],"language":"en","title":"CraftedSignal Threat Feed - Fast-Uri \u003e= 3.0.0, \u003c= 3.1.3","version":"https://jsonfeed.org/version/1.1"}