How severe is CVE-2026-16221?

CVE-2026-16221 has a CVSS 3.x base score of 7.5, rated high severity. It is exploitable over network with low attack complexity, requires no privileges and no user interaction. Impact on confidentiality is none, integrity high, and availability none.

Is CVE-2026-16221 being actively exploited?

It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (16th percentile), an estimate of the probability of exploitation in the next 30 days.

What products are affected by CVE-2026-16221?

CVE-2026-16221 affects Openjsf Fast-uri. See the affected-products list for the exact vulnerable versions.

How do I fix CVE-2026-16221?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its high severity, prioritise patching exposed systems.

When was CVE-2026-16221 published?

CVE-2026-16221 was published on 2026-07-19 and last updated on 2026-08-05.

CVE-2026-16221

CVE-2026-16221 is a high-severity vulnerability in Openjsf Fast-uri with a CVSS 3.x base score of 7.5. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-436.

Key facts

Severity: High (CVSS 3.x base score 7.5)
EPSS exploit prediction: 0% (16th percentile)
Actively exploited: Not listed in CISA KEV
Weakness: CWE-436
Affected product: Openjsf Fast-uri
Published: 2026-07-19
Last modified: 2026-08-05

Description

Impact: fast-uri versions from 2.3.1 through 4.1.0 (including the 3.x line up to 3.1.3 and the 2.x line up to 2.4.2) do not treat a literal backslash character (U+005C) as an authority delimiter. Node's native WHATWG URL parser, used by fetch, undici, and Node's http and https clients, normalizes the backslash to a forward slash for special schemes such as http, https, ws, wss, ftp, and file. As a result, the two parsers extract different hosts from the same input string. Applications that use fast-uri to enforce host-based policy such as allowlists, denylists, loopback or SSRF filtering, redirect validation, or outbound proxy routing before passing the same URL into Node's URL or fetch consumers can be steered to an unintended destination, including cloud metadata endpoints, loopback, or internal hosts. Patches: upgrade to fast-uri 4.1.1, 3.1.4, or 2.4.3. Workarounds: none.

Frequently asked questions

What is CVE-2026-16221?: Impact: fast-uri versions from 2.3.1 through 4.1.0 (including the 3.x line up to 3.1.3 and the 2.x line up to 2.4.2) do not treat a literal backslash character (U+005C) as an authority delimiter. Node's native WHATWG URL parser, used by fetch, undici, and Node's http and https clients, normalizes the backslash to a forward slash for special schemes such as http, https, ws, wss, ftp, and file. As a result, the two parsers extract different hosts from the same input string. Applications that use fast-uri to enforce host-based policy such as allowlists, denylists, loopback or SSRF filtering, redirect validation, or outbound proxy routing before passing the same URL into Node's URL or fetch consumers can be steered to an unintended destination, including cloud metadata endpoints, loopback, or internal hosts. Patches: upgrade to fast-uri 4.1.1, 3.1.4, or 2.4.3. Workarounds: none.
How severe is CVE-2026-16221?: CVE-2026-16221 has a CVSS 3.x base score of 7.5, rated high severity. It is exploitable over network with low attack complexity, requires no privileges and no user interaction. Impact on confidentiality is none, integrity high, and availability none.
Is CVE-2026-16221 being actively exploited?: It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (16th percentile), an estimate of the probability of exploitation in the next 30 days.
What products are affected by CVE-2026-16221?: CVE-2026-16221 affects Openjsf Fast-uri. See the affected-products list for the exact vulnerable versions.
How do I fix CVE-2026-16221?: Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its high severity, prioritise patching exposed systems.
When was CVE-2026-16221 published?: CVE-2026-16221 was published on 2026-07-19 and last updated on 2026-08-05.

References

Affected products (1)

cpe:2.3:a:openjsf:fast-uri:*:*:*:*:*:node.js:*:*

More vulnerabilities in Openjsf Fast-uri

CVE-2026-84394 — High (CVSS 7.5): fast-uri accepts a host that contains an unbalanced or misplaced authority bracket without reporting an error. A host…
CVE-2026-84292 — High (CVSS 7.5): fast-uri serializes the port component of a URI without validating it. When recomposing the authority, the userinfo and…
CVE-2026-76172 — High (CVSS 7.5): fast-uri is a URI parser for Node.js. During parsing it runs a legacy decoding pass over the scheme component and never…
CVE-2026-75975 — High (CVSS 7.5): fast-uri is a URI parser for Node.js. Its custom parser for bracketed IPv6 literals does not validate the complete IPv6…
CVE-2026-75931 — High (CVSS 7.5): fast-uri is a URI parser for Node.js. It canonicalizes a host to its ASCII form only when the input carries an explicit…
CVE-2026-75899 — High (CVSS 7.5): fast-uri is a URI parser for Node.js. It decodes percent escapes in a hostname during parsing and then decodes the…

All CVEs affecting Openjsf Fast-uri →

Other CWE-436 vulnerabilities

CVE-2023-24813 — Critical (CVSS 10.0): Dompdf is an HTML to PDF converter written in php. Due to the difference in the attribute parser of Dompdf and…
CVE-2026-63030 — Critical (CVSS 9.8): WordPress 6.9.x before 6.9.5 and 7.0.x before 7.0.2 is affected by a REST API batch endpoint route confusion issue…
CVE-2026-47767 — Critical (CVSS 9.8): Symfony is a PHP framework for web and console applications and a set of reusable PHP components. From 5.4.46 until…
CVE-2026-8034 — Critical (CVSS 9.8): A server-side request forgery (SSRF) vulnerability was identified in the GitHub Enterprise Server notebook viewer that…
CVE-2021-45327 — Critical (CVSS 9.8): Gitea before 1.11.2 is affected by Trusting HTTP Permission Methods on the Server Side when referencing the vulnerable…
CVE-2020-10180 — Critical (CVSS 9.8): The ESET AV parsing engine allows virus-detection bypass via a crafted BZ2 Checksum field in an archive. This affects…

Browse all CWE-436 vulnerabilities →