fast-uri CVE-2026-16221

Host-based security policy bypass in the fast-uri Node.js URI parser (versions 2.3.1 through 3.1.2 and 4.0.0) lets remot

Security filter bypass in fast-uri (before versions 4.1.2, 3.1.5, and 2.4.4) enables unauthenticated remote attackers to

Path normalization bypass in fast-uri 3.1.0 and earlier allows remote attackers to circumvent path-based access controls

Authority confusion in fast-uri JavaScript library allows remote attackers to bypass URL validation security controls. T

Host confusion in fast-uri, a Node.js URI parser in the Fastify ecosystem, allows policy bypass by exploiting inconsiste

Server-side request forgery and address-policy bypass in fast-uri, the Node.js URI parser used widely in the fastify eco

Double-decoding of percent-encoded hostnames in fast-uri (Node.js URI parser) creates a server-side request forgery and

Parsing and serialization inconsistency in fast-uri, the Node.js URI parser core to the Fastify ecosystem, allows networ

URI authority injection in fast-uri allows an attacker-supplied port value containing delimiter characters to demote the

Host-parsing ambiguity in fast-uri allows attackers to silently bypass SSRF denylists, redirect allowlists, and proxy ro