CVE-2026-16221: CVE-2026-16221: Interpretation Conflict leading to Host Confusion and SSRF Bypass in fast-uri

CVE-2026-16221: Interpretation Conflict leading to Host Confusion and SSRF Bypass in fast-uri

Vulnerability ID: CVE-2026-16221
CVSS Score: 7.5
Published: 2026-07-21

An interpretation conflict (CWE-436) exists in fast-uri due to differing handling of backslash characters between RFC 3986 and the WHATWG URL specification. This differential allows remote attackers to bypass SSRF filters and origin-allowlist protections when fast-uri is used in conjunction with WHATWG-compliant HTTP clients like Node.js native fetch or undici.

TL;DR

A difference in backslash parsing between fast-uri (RFC 3986) and Node.js fetch (WHATWG) allows attackers to bypass URL host checks and perform SSRF.

---

⚠️ Exploit Status: POC

Technical Details

• CWE ID: CWE-436 (Interpretation Conflict)
• Attack Vector: Network (Unauthenticated)
• CVSS v3.1 Score: 7.5 (High)
• EPSS Score: 0.00221 (Percentile: 12.73%)
• Impact: Bypass of Security Policies / Host-Validation Controls
• Exploit Status: Proof of Concept (PoC) documented in official advisory
• KEV Status: Not Listed

Affected Systems

• Node.js applications consuming fast-uri for validation alongside WHATWG-compliant HTTP clients (e.g., native fetch, undici).
• fast-uri: >= 2.3.1, < 2.4.3 (Fixed in: 2.4.3)
• fast-uri: >= 3.0.0, < 3.1.4 (Fixed in: 3.1.4)
• fast-uri: >= 4.0.0, < 4.1.1 (Fixed in: 4.1.1)

Code Analysis

Commit: 9438266

Fix: reject literal backslashes in authority component to prevent SSRF bypasses via host confusion.

Commit: 2d50fba

Backport security fix for backslash authority delimiters to older stable branches.

Exploit Details

• GitHub Security Advisory (GHSA-v2hh-gcrm-f6hx): Advisory documenting the proof of concept payload structure and internal test cases for host verification bypass.

Mitigation Strategies

• Upgrade fast-uri dependency to patched versions: 2.4.3, 3.1.4, or 4.1.1 depending on release branch.
• Implement client-side input validation pre-filters to explicitly reject any URL containing literal backslashes in the authority block.
• Harmonize the application architecture to use the same URL parsing engine (e.g., standard WHATWG URL parser) for both host validation and connection execution.

Remediation Steps:

1. Identify all direct and indirect dependencies on the fast-uri package via npm list fast-uri.
2. Run npm install fast-uri@4.1.1 (or the relevant security release for legacy v3/v2 lines) to apply the patch.
3. For nested transient dependencies, use the overrides field (npm) or resolutions field (yarn) in package.json to force the secure version.
4. Verify the remediation by running a test case parsing http://evil.com\\@allowed.com and asserting that parsed.error is present.

References

• GHSA-v2hh-gcrm-f6hx: Authority backslash normalization bypass
• NVD - CVE-2026-16221 Detailed Analysis
• OpenJS Foundation Security Advisories

---

Read the full report for CVE-2026-16221 on our website for more details including interactive diagrams and full exploit analysis.