Is CVE-2026-16221 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-16221 being exploited in the wild.

How severe is CVE-2026-16221?

High severity, with a CVSS score of 7.5, published 19 July 2026.

Which products and versions are affected?

fast-uri (npm) SEMVER:introduced=2.3.1,fixed=2.4.3.

Is there a fix for CVE-2026-16221?

Yes. fast-uri (npm): upgrade to 2.4.3 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-16221 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-16221?

Check whether you run fast-uri (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-16221: fastify fast-uri host confusion via backslash authority delimiter

CVE-2026-16221 · Severity: high · CVSS 7.5 · Published 2026-07-19

A vulnerability in the fast-uri library, a tool used for high-performance URL parsing in Node.js applications, could allow attackers to bypass security filters. By using a backslash in a URL, an attacker can trick the system into validating a safe-looking address while actually connecting to a malicious or restricted internal destination. This could lead to unauthorized access to internal services or sensitive cloud metadata.

Technologies: fast-uri (npm). Vendors: npm.

Quick answers

Is CVE-2026-16221 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-16221 being exploited in the wild.
How severe is CVE-2026-16221?: High severity, with a CVSS score of 7.5, published 19 July 2026.
Which products and versions are affected?: fast-uri (npm) SEMVER:introduced=2.3.1,fixed=2.4.3.
Is there a fix for CVE-2026-16221?: Yes. fast-uri (npm): upgrade to 2.4.3 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-16221 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-16221?: Check whether you run fast-uri (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

fast-uri (npm): upgrade to 2.4.3 or later
```
npm install fast-uri@2.4.3
```

Technical details

The fast-uri library fails to recognize the literal backslash (U+005C) as an authority delimiter, whereas Node.js native WHATWG URL parsers (used in fetch and undici) normalize backslashes to forward slashes for special schemes like HTTP/HTTPS. This discrepancy creates an interpretation conflict (CWE-436). An attacker can craft a URL such as 'http://evil.com\@allowed.com' which fast-uri identifies as 'allowed.com', but Node.js clients interpret as 'evil.com'. This desync allows for Server-Side Request Forgery (SSRF) and bypasses for allowlists or redirect validations. The issue is fixed in versions 2.4.3, 3.1.4, and 4.1.1.

Affected products

fastify fast-uri >= 2.3.1, <= 2.4.2
fastify fast-uri >= 3.0.0, <= 3.1.3
fastify fast-uri >= 4.0.0, <= 4.1.0

Identifiers

CVE-2026-16221
GHSA-v2hh-gcrm-f6hx

Timeline

2026-07-19: disclosed
2026-07-21: advisory

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.