Host Parsing Issue in fast-uri by Fastify

CVE-2026-16221

What is CVE-2026-16221?

The vulnerability in fast-uri affects versions from 2.3.1 through 4.1.0, where a literal backslash is not treated as an authority delimiter. This discrepancy leads to different host extraction by the Node's native WHATWG URL parser and fast-uri, potentially allowing attackers to redirect requests to unintended destinations such as cloud metadata endpoints. Applications validating URLs with fast-uri may inadvertently expose themselves to security risks, especially in contexts involving allowlists, denylists, or proxy routing. To mitigate this issue, users are advised to upgrade to fast-uri versions 4.1.1, 3.1.4, or 2.4.3 as no alternative workarounds are available.

References