CVE-2026-16221 Overview
CVE-2026-16221 is a parser differential vulnerability in the fast-uri Node.js library that enables host-based policy bypass. The library fails to treat a literal backslash character (U+005C) as an authority delimiter. Node's native WHATWG URL parser normalizes backslashes to forward slashes for special schemes such as http, https, ws, wss, ftp, and file. The two parsers therefore extract different hosts from the same input string. Applications that use fast-uri for allowlist enforcement, Server-Side Request Forgery (SSRF) filtering, or redirect validation before passing URLs to fetch, undici, or Node's HTTP clients can be redirected to unintended destinations. Affected versions span 2.3.1 through 4.1.0. This flaw is classified under [CWE-436] Interpretation Conflict.
Critical Impact
Attackers can bypass host-based security controls to reach cloud metadata endpoints, loopback interfaces, and internal hosts through crafted URLs containing backslash characters.
Affected Products
- fast-uri versions 2.3.1 through 2.4.2
- fast-uri versions 3.0.0 through 3.1.3
- fast-uri versions 4.0.0 through 4.1.0
Discovery Timeline
- 2026-07-19 - CVE CVE-2026-16221 published to NVD
- 2026-07-21 - Last updated in NVD database
Technical Details for CVE-2026-16221
Vulnerability Analysis
The vulnerability is a parser differential between fast-uri and Node's built-in WHATWG URL parser. When fast-uri parses a URL such as http://trusted.example.com\@attacker.example.com/, it treats the backslash as part of the path or userinfo and reports the host as trusted.example.com. Node's native URL parser applies WHATWG special-scheme normalization, converting the backslash to a forward slash. The same input becomes http://trusted.example.com/@attacker.example.com/, and downstream fetch or undici requests connect to attacker.example.com.
Applications built on this inconsistency lose the security guarantee they expect. SSRF filters that block 169.254.169.254, 127.0.0.1, or internal ranges may pass validation against a benign apparent host while the actual outbound request reaches cloud metadata services, loopback listeners, or intranet resources.
Root Cause
The library does not implement WHATWG-compliant delimiter handling for special schemes. RFC 3986 treats backslash as a regular character, but WHATWG requires backslash-to-slash normalization for http, https, ws, wss, ftp, and file. fast-uri follows RFC 3986 semantics while Node's runtime consumers follow WHATWG, producing divergent host extraction.
Attack Vector
Exploitation requires an application that validates URLs with fast-uri and then dispatches HTTP requests through fetch, undici, or http/https clients. An attacker submits a URL with a backslash placed to separate a validator-visible host from the runtime-visible host. Common targets include webhook endpoints, redirect handlers, PDF or screenshot generators, and outbound proxy routers. The vulnerability does not require authentication or user interaction.
See the GitHub Security Advisory GHSA-v2hh-gcrm-f6hx for the reference advisory.
Detection Methods for CVE-2026-16221
Indicators of Compromise
- Outbound HTTP requests to 169.254.169.254, 100.100.100.200, or metadata.google.internal originating from application servers that should not access cloud metadata
- Application logs showing URLs containing literal backslash (\) characters in host or authority positions
- Discrepancies between logged validated hostnames and destination hosts recorded by outbound proxies or firewalls
Detection Strategies
- Inventory dependency trees for fast-uri versions in the vulnerable range (2.3.1–2.4.2, 3.0.0–3.1.3, 4.0.0–4.1.0) using npm ls fast-uri or Software Composition Analysis tooling
- Deploy Web Application Firewall (WAF) rules that flag or block backslash characters in URL parameters passed to server-side URL validators
- Correlate application-level URL validation logs against egress proxy logs to identify host mismatches
Monitoring Recommendations
- Alert on any outbound connection from application workloads to link-local metadata IP ranges
- Monitor Node.js application telemetry for URL parsing errors and unusual redirect chains
- Track fast-uri package versions across CI/CD pipelines and container images to detect regressions
How to Mitigate CVE-2026-16221
Immediate Actions Required
- Upgrade fast-uri to 4.1.1, 3.1.4, or 2.4.3 depending on the major version in use
- Audit application code that validates URLs before passing them to fetch, undici, or Node HTTP clients
- Block Instance Metadata Service (IMDS) access at the network layer for workloads that do not require it, or enforce IMDSv2 with hop-limit restrictions on AWS
Patch Information
The maintainers released fixes in fast-uri4.1.1, 3.1.4, and 2.4.3. Update package manifests and lockfiles, then rebuild and redeploy affected services. Reference the OpenJS Foundation Security Advisories for coordinated advisory details.
Workarounds
- No official workarounds exist; upgrading is the required remediation
- As a compensating control, reject any input URL containing a backslash character before it reaches the validator
- Enforce host allowlists after WHATWG parsing by re-parsing the URL with Node's native URL constructor and validating the resulting hostname property
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
