Host confusion via backslash authority delimiter in fast-uri (CVE-2026-16221)

fast-uri versions from 2.3.1 through 4.1.0 do not treat a literal backslash character (U+005C) as an authority delimiter, while Node's native WHATWG URL parser normalizes backslashes to forward slashes for special schemes. This parsing discrepancy allows an attacker to cause a policy/use desync in applications that rely on fast-uri for host-based enforcement - such as allowlists, SSRF filtering, or redirect validation - before passing the same URL to Node's URL or fetch consumers, potentially steering requests to unintended destinations including cloud metadata endpoints, loopback, or internal hosts. Affected versions: - >= 2.3.1, <= 2.4.2 - >= 3.0.0, <= 3.1.3 - >= 4.0.0, <= 4.1.0 We recommend updating to: 2.4.3, 3.1.4, 4.1.1. CVSS 7.5 · our assessment: this_week Vendor advisory: https://github.com/fastify/fast-uri/security/advisories/GHSA-v2hh-gcrm-f6hx Details: https://vuln.today/cve/CVE-2026-16221