Skip to content
Threat Feed
Subscribe

Tag

Host-Confusion

2 briefs RSS
high advisory

Fast-uri Library Host Confusion Vulnerability (CVE-2026-16221)

The `fast-uri` library, in versions prior to 4.1.1, 3.1.4, and 2.4.3, is vulnerable to a host confusion issue (CVE-2026-16221) due to its failure to treat a literal backslash as an authority delimiter, enabling attackers to bypass host-based security policies via Server-Side Request Forgery (SSRF) or unauthorized access to internal resources.

fast-uri <= 2.4.2 +2 host-confusion ssrf dependency-vulnerability node.js
1c
high advisory

fast-uri Host Confusion Vulnerability via Percent-Encoded Authority Delimiters (CVE-2026-6322)

The fast-uri library is vulnerable to host confusion due to improper handling of percent-encoded authority delimiters within the host component, potentially leading to redirection to unintended authorities.

fast-uri host-confusion url-parsing cve-2026-6322
2r 1t 1c