CVE-2026-16221: fastify fast-uri host confusion via backslash authority delimiter

Executive brief

A vulnerability in the fast-uri library, a tool used for high-performance URL parsing in Node.js applications, could allow attackers to bypass security filters. By using a backslash in a URL, an attacker can trick the system into validating a safe-looking address while actually connecting to a malicious or restricted internal destination. This could lead to unauthorized access to internal services or sensitive cloud metadata.

Technical details

The fast-uri library fails to recognize the literal backslash (U+005C) as an authority delimiter, whereas Node.js native WHATWG URL parsers (used in fetch and undici) normalize backslashes to forward slashes for special schemes like HTTP/HTTPS. This discrepancy creates an interpretation conflict (CWE-436). An attacker can craft a URL such as 'http://evil.com\@allowed.com' which fast-uri identifies as 'allowed.com', but Node.js clients interpret as 'evil.com'. This desync allows for Server-Side Request Forgery (SSRF) and bypasses for allowlists or redirect validations. The issue is fixed in versions 2.4.3, 3.1.4, and 4.1.1.

Affected products

• fastify fast-uri >= 2.3.1, <= 2.4.2
• fastify fast-uri >= 3.0.0, <= 3.1.3
• fastify fast-uri >= 4.0.0, <= 4.1.0

Timeline

• 2026-07-19: disclosed
• 2026-07-21: advisory

References

• https://api.github.com/users/rampage0010
• https://github.com/rampage0010
• https://api.github.com/users/rampage0010/gists%7B/gist_id%7D
• https://api.github.com/users/rampage0010/repos
• https://avatars.githubusercontent.com/u/65641631?v=4
• https://api.github.com/users/rampage0010/events%7B/privacy%7D