How severe is CVE-2026-16221?

CVE-2026-16221 has a CVSS 3.x base score of 7.5, rated high severity. It is exploitable over network with low attack complexity, requires no privileges and no user interaction. Impact on confidentiality is none, integrity high, and availability none.

Is CVE-2026-16221 being actively exploited?

It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (17th percentile), an estimate of the probability of exploitation in the next 30 days.

What products are affected by CVE-2026-16221?

CVE-2026-16221 affects Openjsf Fast-uri. See the affected-products list for the exact vulnerable versions.

How do I fix CVE-2026-16221?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its high severity, prioritise patching exposed systems.

When was CVE-2026-16221 published?

CVE-2026-16221 was published on 2026-07-19 and last updated on 2026-08-05.

CVE-2026-16221

CVE-2026-16221 is a high-severity vulnerability in Openjsf Fast-uri with a CVSS 3.x base score of 7.5. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-436.

Key facts

Severity: High (CVSS 3.x base score 7.5)
EPSS exploit prediction: 0% (17th percentile)
Actively exploited: Not listed in CISA KEV
Weakness: CWE-436
Affected product: Openjsf Fast-uri
Published: 2026-07-19
Last modified: 2026-08-05

Description

Impact: fast-uri versions from 2.3.1 through 4.1.0 (including the 3.x line up to 3.1.3 and the 2.x line up to 2.4.2) do not treat a literal backslash character (U+005C) as an authority delimiter. Node's native WHATWG URL parser, used by fetch, undici, and Node's http and https clients, normalizes the backslash to a forward slash for special schemes such as http, https, ws, wss, ftp, and file. As a result, the two parsers extract different hosts from the same input string. Applications that use fast-uri to enforce host-based policy such as allowlists, denylists, loopback or SSRF filtering, redirect validation, or outbound proxy routing before passing the same URL into Node's URL or fetch consumers can be steered to an unintended destination, including cloud metadata endpoints, loopback, or internal hosts. Patches: upgrade to fast-uri 4.1.1, 3.1.4, or 2.4.3. Workarounds: none.

Frequently asked questions

What is CVE-2026-16221?: Impact: fast-uri versions from 2.3.1 through 4.1.0 (including the 3.x line up to 3.1.3 and the 2.x line up to 2.4.2) do not treat a literal backslash character (U+005C) as an authority delimiter. Node's native WHATWG URL parser, used by fetch, undici, and Node's http and https clients, normalizes the backslash to a forward slash for special schemes such as http, https, ws, wss, ftp, and file. As a result, the two parsers extract different hosts from the same input string. Applications that use fast-uri to enforce host-based policy such as allowlists, denylists, loopback or SSRF filtering, redirect validation, or outbound proxy routing before passing the same URL into Node's URL or fetch consumers can be steered to an unintended destination, including cloud metadata endpoints, loopback, or internal hosts. Patches: upgrade to fast-uri 4.1.1, 3.1.4, or 2.4.3. Workarounds: none.
How severe is CVE-2026-16221?: CVE-2026-16221 has a CVSS 3.x base score of 7.5, rated high severity. It is exploitable over network with low attack complexity, requires no privileges and no user interaction. Impact on confidentiality is none, integrity high, and availability none.
Is CVE-2026-16221 being actively exploited?: It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (17th percentile), an estimate of the probability of exploitation in the next 30 days.
What products are affected by CVE-2026-16221?: CVE-2026-16221 affects Openjsf Fast-uri. See the affected-products list for the exact vulnerable versions.
How do I fix CVE-2026-16221?: Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its high severity, prioritise patching exposed systems.
When was CVE-2026-16221 published?: CVE-2026-16221 was published on 2026-07-19 and last updated on 2026-08-05.

References

Affected products (1)

cpe:2.3:a:openjsf:fast-uri:*:*:*:*:*:node.js:*:*

More vulnerabilities in Openjsf Fast-uri

CVE-2026-13676 — High (CVSS 7.5): fast-uri versions 2.3.1 through 3.1.2 and 4.0.0 fail to canonicalize Unicode (IDN) hostnames for HTTP-family URLs. The…
CVE-2026-6322 — High (CVSS 7.5): fast-uri normalize() decoded percent-encoded authority delimiters inside the host component and then re-emitted them as…
CVE-2026-6321 — High (CVSS 7.5): fast-uri decoded percent-encoded path separators and dot segments before applying dot-segment removal in its…

All CVEs affecting Openjsf Fast-uri →

Other CWE-436 vulnerabilities

CVE-2023-24813 — Critical (CVSS 10.0): Dompdf is an HTML to PDF converter written in php. Due to the difference in the attribute parser of Dompdf and…
CVE-2026-63030 — Critical (CVSS 9.8): WordPress 6.9.x before 6.9.5 and 7.0.x before 7.0.2 is affected by a REST API batch endpoint route confusion issue…
CVE-2026-47767 — Critical (CVSS 9.8): Symfony is a PHP framework for web and console applications and a set of reusable PHP components. From 5.4.46 until…
CVE-2026-8034 — Critical (CVSS 9.8): A server-side request forgery (SSRF) vulnerability was identified in the GitHub Enterprise Server notebook viewer that…
CVE-2021-45327 — Critical (CVSS 9.8): Gitea before 1.11.2 is affected by Trusting HTTP Permission Methods on the Server Side when referencing the vulnerable…
CVE-2020-10180 — Critical (CVSS 9.8): The ESET AV parsing engine allows virus-detection bypass via a crafted BZ2 Checksum field in an archive. This affects…

Browse all CWE-436 vulnerabilities →