What is the CVSS score of CVE-2026-16221?

CVE-2026-16221 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N. EPSS exploitation probability: 0.2%.

Is there a public PoC exploit available for CVE-2026-16221?

Yes, a public proof-of-concept exploit is available for CVE-2026-16221. Prioritise patching immediately. EPSS: 0.2%.

How to fix or mitigate CVE-2026-16221?

Within 24 hours, inventory all applications using fast-uri versions 2.3.1 through 4.1.0 and flag those using it for host validation, SSRF prevention, or redirect checking as critical. Within 7 days, upgrade to patched versions released by openjsf, and deploy temporary controls including parallel host validation using Node's native WHATWG URL parser on all security-sensitive URL paths. Within 30 days, verify that all fast-uri instances are on patched versions and that host validation is functioning correctly across all security-sensitive code.

fast-uri CVE-2026-16221

Q: Which versions of fast-uri are affected by CVE-2026-16221?

The fast-uri Node.js library used for URL security validation in web applications contains a host-validation bypass that allows attackers to circumvent access controls and reach cloud metadata…. A patch is available.

EUVD-2026-45551 HIGH

Interpretation Conflict (CWE-436)

2026-07-19 openjs

GHSA-v2hh-gcrm-f6hx

SSRF Red Hat Fast Uri

7.5

CVSS 3.1 · Vendor: openjs

View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

Access

Craft URL with literal backslash in authority
Delivery

Submit to app's host-policy check
Exploit

fast-uri approves benign-looking host
Execution

Node parser normalizes backslash, resolves internal host
Persist

Outbound request hits metadata/loopback endpoint
Impact

Exfiltrate credentials or internal data

Vulnerability Assessment

Weakness	CWE CWE-436 OWASP Top 10:2025 A06:2025 - Insecure Design ASVS 5.0 V4 - API and Web Service Interpretation consistency
Exploitation Conditions	Exploitation requires that the target application (1) uses fast-uri at an affected version (2.3.1-4.1.0) to parse or extract the host from an attacker-influenced URL, (2) makes a security decision on that host - allowlist, denylist, loopback/SSRF filter, redirect validation, or outbound proxy routing - and (3) then passes the SAME raw URL string into a Node consumer backed by the WHATWG URL parser (fetch, undici, http, or https clients) for the actual request. The scheme must be a WHATWG 'special' scheme (http, https, ws, wss, ftp, or file) for Node's backslash-to-slash normalization to trigger. What limits exploitation: the two-parser split-decision pattern must exist in the application - deployments that use fast-uri only for schema validation, or that use the same parser for both the check and the request, are not exploitable. No authentication (PR:N) or user interaction (UI:N) is required where the vulnerable pattern is present.
Impact	The published CVSS 3.1 vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N yields 7.5 (High), modeling an unauthenticated network attacker who bypasses integrity-relevant host controls. In practice the real risk is conditional: the vulnerability only matters when an application uses fast-uri to enforce host-based policy and then hands the same raw URL to a Node fetch/undici/http consumer - this is a specific integration pattern, so the effective attack complexity is higher than AC:L suggests for arbitrary deployments. There is no EPSS score, no CISA KEV listing, and no POC in the provided intelligence, so this is not confirmed as actively exploited; it should be treated as a latent SSRF-enabler rather than a mass-exploited flaw. The impact where the pattern exists is serious (SSRF to cloud metadata can yield credential theft), so the C:N in the vendor vector is arguably understated - SSRF typically carries confidentiality impact. Priority is high for any Node service performing URL allowlisting/SSRF filtering with fast-uri; low for deployments that only use it for schema validation.
Exploit ScenarioDerived	An attacker submits a URL such as http:\\attacker-controlled\@169.254.169.254/ (or similar backslash-laden authority) to a Node application that validates the host with fast-uri and then fetches it via undici/fetch. fast-uri parses one host and approves it against the allowlist while Node's parser normalizes the backslash and connects to a different host - the cloud metadata endpoint - returning IAM credentials to the attacker. No authentication or user interaction is required per the CVSS vector, and no public POC is currently identified.

This Week Schedule remediation this week. Why: HIGH severity (CVSS 7.0-8.9).

Patch available 0.2% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Jul 19, 2026

Host-based policy bypass in the fast-uri Node.js URI parser (versions 2.3.1 through 4.1.0, spanning the 2.x line up to 2.4.2 and the 3.x line up to 3.1.3) allows remote attackers to smuggle a different host past allowlist, denylist, SSRF, loopback, and redirect-validation checks by using a literal backslash. Because fast-uri does not treat U+005C as an authority delimiter while Node's native WHATWG URL parser (used by fetch, undici, and the http/https clients) normalizes backslash to forward slash for special schemes, the two parsers disagree on the host, enabling requests to be steered to cloud metadata, loopback, or internal endpoints. There is no public exploit identified at time of analysis, but the flaw is trivially triggerable in affected deployments and openjsf has published a fix.

RemediationAI

Vendor-released patch: upgrade fast-uri to 4.1.1 (4.x line), 3.1.4 (3.x line), or 2.4.3 (2.x line) depending on the major version you run; these releases make fast-uri treat a literal backslash consistently so its host extraction aligns with Node's WHATWG parser. The vendor states there are no workarounds, so patching is the required fix. As interim compensating controls until you can upgrade, reject or normalize any URL whose authority or path contains a backslash before it reaches your policy check (fail closed on U+005C), and standardize on a single parser end-to-end - use Node's native URL/WHATWG parser for BOTH the security decision and the outbound request so the two cannot disagree; the trade-off is that pre-normalizing input may break rare legitimate URLs containing encoded backslashes. Where feasible, enforce SSRF protection at the network layer as defense in depth by blocking outbound access to 169.254.169.254 and other metadata/loopback/internal ranges from application egress. Track fixes via GHSA-v2hh-gcrm-f6hx (https://github.com/fastify/fast-uri/security/advisories/GHSA-v2hh-gcrm-f6hx).

Affected VersionsENISA

fast-uri 2.3.1 <2.4.3

fast-uri 4.0.0 <4.1.1

fast-uri 3.0.0 <3.1.4

Affected Packages

npm fast-uri fix: 2.4.3, 3.1.4, 4.1.1

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in npm

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Technical ContextAI · show details

The affected component is fast-uri, a high-performance RFC 3986 URI parser widely used in the Fastify ecosystem (notably as ajv's URI resolver) as a drop-in replacement for uri-js. The root cause is classified as CWE-436 (Interpretation Conflict / parser differential): fast-uri follows strict RFC 3986 semantics where a backslash is a normal path character and not part of the authority, whereas Node's built-in WHATWG URL parser - the one backing fetch, undici, and the native http/https clients - applies WHATWG special-scheme normalization that rewrites backslashes to forward slashes for http, https, ws, wss, ftp, and file URLs. When one library extracts the host for a security decision and a different library extracts the host for the actual outbound request, the same input string resolves to two different destinations. The single affected CPE is cpe:2.3:a:fast-uri:fast-uri:*:*:*:*:*:*:*:*.

Know when Fast Uri gets its next vulnerability

Watch products and get an email when something new is published
Check this CVE against your own stack and servers
Exploit and PoC references, threat intelligence from 22 sources

Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (openjs) PRIMARY 7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

vuln.today AI 5.9 MEDIUM

AC:H because exploitation needs the specific fast-uri-check-then-Node-fetch pattern; PR:N/UI:N as attacker-supplied URLs suffice; C:H reflects SSRF to metadata/internal resources over I:N.

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

4.0 AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

SUSE 8.2 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N

Red Hat 7.5 HIGH

Primary rating from Vendor (openjs).

CVSS VectorVendor: openjs

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

High

Availability

None

Lifecycle Timeline

Patch available

Jul 19, 2026 - 16:19 EUVD

CVE Published

Jul 19, 2026 - 14:08 cve.org

HIGH 7.5

DescriptionCVE.org

Impact: fast-uri versions from 2.3.1 through 4.1.0 (including the 3.x line up to 3.1.3 and the 2.x line up to 2.4.2) do not treat a literal backslash character (U+005C) as an authority delimiter. Node's native WHATWG URL parser, used by fetch, undici, and Node's http and https clients, normalizes the backslash to a forward slash for special schemes such as http, https, ws, wss, ftp, and file. As a result, the two parsers extract different hosts from the same input string. Applications that use fast-uri to enforce host-based policy such as allowlists, denylists, loopback or SSRF filtering, redirect validation, or outbound proxy routing before passing the same URL into Node's URL or fetch consumers can be steered to an unintended destination, including cloud metadata endpoints, loopback, or internal hosts.

Patches: upgrade to fast-uri 4.1.1, 3.1.4, or 2.4.3.

Workarounds: none.

Executive ViewAI

Why It Matters

The fast-uri Node.js library used for URL security validation in web applications contains a host-validation bypass that allows attackers to circumvent access controls and reach cloud metadata services and internal resources. The vulnerability is straightforward to exploit, and organizations using affected versions (2.3.1-2.4.2 or 3.0.0-3.1.3) risk unauthorized exposure of cloud credentials and internal infrastructure. Urgent patching is required to prevent compromise.

Business Impact: High

Compensating Controls

Apply vendor patch.

Threat Intelligence Overview

EPSS Score

0.2%

Top 87% exploitable

Prevalence

High

widely used Node URI parser, transitive dependency across the Fastify/ajv ecosystem

Threat Intel

1 source

Exploit

POC

Public exploit code exists

Data Quality

8 sources

Confidence: High

EUVD

NVD

CVE.org

EPSS

Vulnrichment GHSA Vendor

GitHub

VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue

Severity HIGH

CISA KEV No

Public POC Yes

EPSS 0.2%

Patch available Yes

Active threat No

Deciding rule

HIGH severity (CVSS 7.0-8.9)

What every action level means

Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.

Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.

This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.

This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.

Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision

Scheduled

Exploitation

None

System Exposure· derived

Open

Automatable

Yes

Human Impact

High

Technical Impact

Partial

Priority Score

Low Medium High Critical

KEV: 0

EPSS: 0

CVSS: +38

PoC: +20

Weaponized: 0

Threat intel: 0

Gov advisory: 0

Attack Technique

Server-Side Request Forgery HIGH

Server-Side Request Forgery exploits applications that fetch remote resources based on user-supplied URLs.

More in Fast Uri

View all

CVE-2026-75931 HIGH This Week POC

7.5 Aug 24

Host confusion in fast-uri, a Node.js URI parser in the Fastify ecosystem, allows policy bypass by exploiting inconsiste

CVE-2026-75975 HIGH This Week POC

7.5 Aug 24

Server-side request forgery and address-policy bypass in fast-uri, the Node.js URI parser used widely in the fastify eco

CVE-2026-75899 HIGH This Week POC

7.5 Aug 24

Double-decoding of percent-encoded hostnames in fast-uri (Node.js URI parser) creates a server-side request forgery and

CVE-2026-13676 HIGH This Week POC

7.5 Jun 29

Host-based security policy bypass in the fast-uri Node.js URI parser (versions 2.3.1 through 3.1.2 and 4.0.0) lets remot

CVE-2026-76172 HIGH This Week POC

7.5 Aug 24

Parsing and serialization inconsistency in fast-uri, the Node.js URI parser core to the Fastify ecosystem, allows networ

CVE-2026-84292 HIGH This Week POC

7.5 Sep 02

URI authority injection in fast-uri allows an attacker-supplied port value containing delimiter characters to demote the

CVE-2026-18446 HIGH This Week POC

7.5 Jul 31

Security filter bypass in fast-uri (before versions 4.1.2, 3.1.5, and 2.4.4) enables unauthenticated remote attackers to

CVE-2026-6321 HIGH This Week POC

7.5 May 04

Path normalization bypass in fast-uri 3.1.0 and earlier allows remote attackers to circumvent path-based access controls

CVE-2026-6322 HIGH This Week POC

7.5 May 05

Authority confusion in fast-uri JavaScript library allows remote attackers to bypass URL validation security controls. T

CVE-2026-84394 HIGH This Week POC

7.5 Sep 02

Host-parsing ambiguity in fast-uri allows attackers to silently bypass SSRF denylists, redirect allowlists, and proxy ro

CVE-2026-86818 MEDIUM This Month POC

4.8 Sep 15

The mailto scheme parser added to fast-uri 4.1.3 (and still present in 4.1.4) compares query field names against the res

CVE-2026-86472 MEDIUM This Month POC

4.8 Sep 15

Host allowlist and denylist bypass in fast-uri, the dependency-free RFC 3986 URI parser used by Fastify and ajv, affects

Same weakness CWE-436 – Interpretation Conflict

View all

CVE-2026-63030 CRITICAL POC

9.8

CVE-2024-24754 CRITICAL POC

9.8

CVE-2023-24813 CRITICAL POC

9.8

CVE-2019-19589 CRITICAL POC

9.8

CVE-2025-12816 HIGH POC

8.6

CVE-2026-67201 HIGH POC

7.7

Same technique SSRF

View all

CVE-2021-34473 CRITICAL POC

9.1

CVE-2021-26855 CRITICAL POC

9.1

CVE-2021-21985 CRITICAL POC

9.8

CVE-2024-21893 HIGH POC

8.2

CVE-2021-40438 CRITICAL POC

9.0

CVE-2021-22054 HIGH POC

7.5

CVE-2021-21975 HIGH POC

7.5

CVE-2016-3718 MEDIUM POC

5.5

Vendor StatusVendor

SUSE

Severity: Important

Product	Status
SUSE Linux Enterprise Micro 5.3	Not-Affected
SUSE Linux Enterprise Micro 5.3	Not-Affected
SUSE Linux Enterprise Micro 5.3	Not-Affected
SUSE Linux Enterprise Micro 5.3	Not-Affected
SUSE Linux Enterprise Micro 5.4	Not-Affected

References

Advisories & patches

ADVISORY https://github.com/fastify/fast-uri/commit/0542a216860fd70c062a4730e620576f62ded057 ADVISORY https://github.com/fastify/fast-uri/commit/2d50fbabc80e4d0884fe0f6a98fe118ce6faa353 ADVISORY https://github.com/fastify/fast-uri/commit/9438266d6a7ded688c8bc7c4ba506da17f44a17b ADVISORY https://github.com/fastify/fast-uri/releases/tag/v2.4.3 ADVISORY https://github.com/fastify/fast-uri/releases/tag/v3.1.4 ADVISORY https://github.com/fastify/fast-uri/releases/tag/v4.1.1 ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2026-16221 ADVISORY https://vuldb.com/vuln/380162 REF https://cna.openjsf.org/security-advisories.html REF https://github.com/fastify/fast-uri/security/advisories/GHSA-v2hh-gcrm-f6hx

Search Externally

GitHub PoC

Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC

Back