Product
The `fast-uri` library, in versions prior to 4.1.1, 3.1.4, and 2.4.3, is vulnerable to a host confusion issue (CVE-2026-16221) due to its failure to treat a literal backslash as an authority delimiter, enabling attackers to bypass host-based security policies via Server-Side Request Forgery (SSRF) or unauthorized access to internal resources.