CVE-2026-16221

Impact: fast-uri versions from 2.3.1 through 4.1.0 (including the 3.x line up to 3.1.3 and the 2.x line up to 2.4.2) do not treat a literal backslash character (U+005C) as an authority delimiter. Node's native WHATWG URL parser, used by fetch, undici, and Node's http and https clients, normalizes the backslash to a forward slash for special schemes such as http, https, ws, wss, ftp, and file. As a result, the two parsers extract different hosts from the same input string. Applications that use fast-uri to enforce host-based policy such as allowlists, denylists, loopback or SSRF filtering, redirect validation, or outbound proxy routing before passing the same URL into Node's URL or fetch consumers can be steered to an unintended destination, including cloud metadata endpoints, loopback, or internal hosts. Patches: upgrade to fast-uri 4.1.1, 3.1.4, or 2.4.3. Workarounds: none.

• CWE-436

• https://cna.openjsf.org/security-advisories.html
• https://github.com/fastify/fast-uri/security/advisories/GHSA-v2hh-gcrm-f6hx

Published

Jul 19, 2026

Last Modified

Jul 20, 2026

Status

Received

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-16216A weakness has been identified in geex-arts django-jet up to…4.3
• CVE-2026-16217A security vulnerability has been detected in guohongze admi…6.3
• CVE-2026-16218A vulnerability was detected in hunvreus devpush up to 0.4.6…2.6
• CVE-2026-16219A flaw has been found in Croogo CMS up to 4.0.7. This affect…6.3
• CVE-2026-1622Neo4j Enterprise and Community editions versions prior to 20…4.8
• CVE-2026-16220A vulnerability has been found in code-projects Online Exami…4.3
• CVE-2026-16222A vulnerability was found in 1Panel-dev CordysCRM up to 1.4.…6.3
• CVE-2026-16223A vulnerability was determined in 1Panel-dev CordysCRM up to…6.3
• CVE-2026-16224A vulnerability was identified in jxxghp MoviePilot up to 2.…5.3
• CVE-2026-16225A security flaw has been discovered in davenardella snap7 up…6.3
• CVE-2026-16226A weakness has been identified in SourceCodester Pizzafy Eco…5.1
• CVE-2026-16227A security vulnerability has been detected in SourceCodester…7.3