fast-uri vulnerable to host confusion via literal backslash authority delimiter
Priority LOW 39CWE-436Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- None · High · None
- Fix status
- Partial Red Hat: 13 fixed, 19 without a fix
Attack profile from CVSS 3.1 · CNA. Fix status from CNA, GitHub and Red Hat.
Summary
Impact: fast-uri versions from 2.3.1 through 4.1.0 (including the 3.x line up to 3.1.3 and the 2.x line up to 2.4.2) do not treat a literal backslash character (U+005C) as an authority delimiter. Node's native WHATWG URL parser, used by fetch, undici, and Node's http and https clients, normalizes the backslash to a forward slash for special schemes such as http, https, ws, wss, ftp, and file. As a result, the two parsers extract different hosts from the same input string. Applications that use fast-uri to enforce host-based policy such as allowlists, denylists, loopback or SSRF filtering, redirect validation, or outbound proxy routing before passing the same URL into Node's URL or fetch consumers can be steered to an unintended destination, including cloud metadata endpoints, loopback, or internal hosts. Patches: upgrade to fast-uri 4.1.1, 3.1.4, or 2.4.3. Workarounds: none.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00436 38th percentileScored 2026-11-07
Fix Partial fast-uri (fast-uri): 2.4.3, 3.1.4, 4.1.1fast-uri (npm): 2.4.3, 3.1.4, 4.1.1Red Hat: 15 advisoriesRed Hat: 13 fixed, 19 without a fix
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- Yes
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| fast-uri | fast-uri | 2.3.1 to before 2.4.3; 3.0.0 to before 3.1.4; 4.0.0 to before 4.1.1 | 2.4.3, 3.1.4, 4.1.1 | Patch available | CNA |
| — | fast-uri (npm) | 2.3.1 to before 2.4.3 | 2.4.3 | Patch available | GHSA-v2hh-gcrm-f6hx |
| — | fast-uri (npm) | 3.0.0 to before 3.1.4 | 3.1.4 | Patch available | GHSA-v2hh-gcrm-f6hx |
| — | fast-uri (npm) | 4.0.0 to before 4.1.1 | 4.1.1 | Patch available | GHSA-v2hh-gcrm-f6hx |
- fast-uri Vendorfast-uri Affected 2.3.1 to before 2.4.3; 3.0.0 to before 3.1.4; 4.0.0 to before 4.1.1 Fixed in 2.4.3, 3.1.4, 4.1.1 Patch available CNA
- fast-uri (npm) Vendor— Affected 2.3.1 to before 2.4.3 Fixed in 2.4.3 Patch available GHSA-v2hh-gcrm-f6hx
- fast-uri (npm) Vendor— Affected 3.0.0 to before 3.1.4 Fixed in 3.1.4 Patch available GHSA-v2hh-gcrm-f6hx
- fast-uri (npm) Vendor— Affected 4.0.0 to before 4.1.1 Fixed in 4.1.1 Patch available GHSA-v2hh-gcrm-f6hx
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:openjsf:fast-uri:*:*:*:*:*:node.js:*:* | 2.3.1 to before 2.4.3; 3.0.0 to before 3.1.4; 4.0.0 to before 4.1.1 | Vulnerable | fast-uri |
- cpe:2.3:a:openjsf:fast-uri:*:*:*:*:*:node.js:*:* Versions 2.3.1 to before 2.4.3; 3.0.0 to before 3.1.4; 4.0.0 to before 4.1.1 Vulnerable ·fast-uri
Remediation
- Fix · CNA fast-uri (fast-uri) Fixed in 2.4.3, 3.1.4, 4.1.1
- Fix · GHSA-v2hh-gcrm-f6hx fast-uri (npm) Fixed in 2.4.3 Advisory →
- Fix · GHSA-v2hh-gcrm-f6hx fast-uri (npm) Fixed in 3.1.4 Advisory →
- Fix · GHSA-v2hh-gcrm-f6hx fast-uri (npm) Fixed in 4.1.1 Advisory →
Red Hat 15 advisories
- RHSA-2026:92510 Released 2026-10-29 · Red Hat rating CriticalRHOAI 3.4.6 - Red Hat OpenShift AI
- Red Hat OpenShift AI 3.4 registry.redhat.io/rhoai/odh-built-in-detector-rhel9, registry.redhat.io/rhoai/odh-cli-rhel9, registry.redhat.io/rhoai/odh-dashboard-rhel9 +47
- RHSA-2026:87410 Released 2026-10-21 · Red Hat rating CriticalRHOAI 2.25.12 - Red Hat OpenShift AI
- Red Hat OpenShift AI 2.25 registry.redhat.io/rhoai/odh-built-in-detector-rhel9, registry.redhat.io/rhoai/odh-caikit-nlp-rhel9, registry.redhat.io/rhoai/odh-codeflare-operator-rhel9 +47
- RHSA-2026:84734 Released 2026-10-19 · Red Hat rating CriticalRHOAI 3.4.5 - Red Hat OpenShift AI
- Red Hat OpenShift AI 3.4 registry.redhat.io/rhoai/odh-ai-gateway-payload-processing-rhel9, registry.redhat.io/rhoai/odh-automl-rhel9, registry.redhat.io/rhoai/odh-autorag-rhel9 +47
Show 12 more Red Hat advisories
- RHSA-2026:81110 Released 2026-10-12 · Red Hat rating ImportantRed Hat Quay 3.18.1
- Red Hat Quay 3.18 registry.redhat.io/quay/quay-builder-rhel9, registry.redhat.io/quay/quay-rhel9
- RHSA-2026:74511 Released 2026-10-01 · Red Hat rating ImportantRed Hat Quay 3.17.5
- Red Hat Quay 3.17 registry.redhat.io/quay/quay-rhel9
- RHSA-2026:73987 Released 2026-09-30 · Red Hat rating CriticalRHOAI 3.3.7 - Red Hat OpenShift AI
- Red Hat OpenShift AI 3.3 registry.redhat.io/rhoai/odh-built-in-detector-rhel9, registry.redhat.io/rhoai/odh-dashboard-rhel9, registry.redhat.io/rhoai/odh-data-science-pipelines-argo-argoexec-rhel9 +47
- RHSA-2026:70267 Released 2026-09-22 · Red Hat rating ImportantRed Hat Quay 3.14.9
- Red Hat Quay 3.14 registry.redhat.io/quay/quay-rhel8
- RHSA-2026:68553 Released 2026-09-22 · Red Hat rating ImportantOpenShift Container Platform 4.22.15 security and extras update
- Red Hat OpenShift Container Platform 4.22 registry.redhat.io/openshift4/nmstate-console-plugin-rhel9, registry.redhat.io/openshift4/ose-sriov-network-config-daemon-rhel9, registry.redhat.io/openshift4/ose-sriov-network-rhel9-operator
- RHSA-2026:68547 Released 2026-09-22 · Red Hat rating ImportantOpenShift Container Platform 4.21.34 security and extras update
- Red Hat OpenShift Container Platform 4.21 registry.redhat.io/openshift4/nmstate-console-plugin-rhel9, registry.redhat.io/openshift4/ose-node-feature-discovery-rhel9, registry.redhat.io/openshift4/ose-sriov-network-config-daemon-rhel9 +1
- RHSA-2026:69255 Released 2026-09-21 · Red Hat rating ImportantRed Hat Quay 3.16.6
- Red Hat Quay 3.16 registry.redhat.io/quay/quay-rhel9
- RHSA-2026:68681 Released 2026-09-17 · Red Hat rating ImportantMigration Toolkit for Containers (MTC) 1.8.17 update
- Red Hat Migration Toolkit 1.8 registry.redhat.io/rhmtc/openshift-migration-registry-rhel8, registry.redhat.io/rhmtc/openshift-migration-ui-rhel8
- RHSA-2026:65514 Released 2026-09-08 · Red Hat rating ImportantRed Hat Quay 3.9.26
- Red Hat Quay 3.9 registry.redhat.io/quay/quay-rhel8
- RHSA-2026:65130 Released 2026-09-08 · Red Hat rating ImportantRed Hat OpenShift Data Foundation 4.22.3 security, enhancement & bug fix update
- Red Hat Openshift Data Foundation 4.22 registry.redhat.io/odf4/cephcsi-rhel9, registry.redhat.io/odf4/cephcsi-rhel9-operator, registry.redhat.io/odf4/devicefinder-rhel9 +25
- RHSA-2026:54518 Released 2026-08-13 · Red Hat rating ImportantRed Hat Hardened Images RPMs Security Update
- Red Hat Hardened Images grafana12.4-12.4.8-0.1.1.hum1@aarch64, grafana12.4-12.4.8-0.1.1.hum1@src, grafana12.4-12.4.8-0.1.1.hum1@x86_64
- RHSA-2026:54517 Released 2026-08-13 · Red Hat rating ImportantRed Hat Hardened Images RPMs Security Update
- Red Hat Hardened Images grafana13.1-13.1.3-0.1.1.hum1@aarch64, grafana13.1-13.1.3-0.1.1.hum1@src, grafana13.1-13.1.3-0.1.1.hum1@x86_64
Vendor assessments
Red Hat
Red Hat rating: Important. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Multicluster Engine for Kubernetes | Affected | — |
| OpenShift Lightspeed | Affected | No fix yet |
| OpenShift Serverless | Affected | No fix yet |
| Red Hat Advanced Cluster Management for Kubernetes 2 | Affected | — |
| Red Hat Ansible Automation Platform 2 | Affected | — |
| Red Hat Connectivity Link 1 | Affected | No fix yet |
| Red Hat Discovery 2 | Affected | — |
| Red Hat Edge Manager 1 | Affected | — |
| Red Hat Enterprise Linux 10 | Affected | — |
| Red Hat Enterprise Linux 8 | Affected | — |
| Red Hat Enterprise Linux 9 | Affected | — |
| Red Hat Enterprise Linux AI (RHEL AI) 3 | Affected | No fix yet |
| Red Hat OpenShift AI (RHOAI) | Affected | No fix yet |
| Red Hat OpenShift Container Platform 4 | Affected | No fix yet |
| Red Hat OpenShift Container Platform 5 | Affected | No fix yet |
| Red Hat Satellite 6 | Affected | — |
| Red Hat build of Apicurio Registry 3 | Affected | No fix yet |
| Secrets Management Console for Red Hat OpenShift | Affected | — |
| Self-service automation portal 2 | Affected | — |
| Red Hat Hardened Images | Fixed | RHSA-2026:54517, RHSA-2026:54518 |
| Red Hat Migration Toolkit 1.8 | Fixed | RHSA-2026:68681 |
| Red Hat OpenShift AI 2.25 | Fixed | RHSA-2026:87410 |
| Red Hat OpenShift AI 3.3 | Fixed | RHSA-2026:73987 |
| Red Hat OpenShift AI 3.4 | Fixed | RHSA-2026:84734, RHSA-2026:92510 |
| Red Hat OpenShift Container Platform 4.21 | Fixed | RHSA-2026:68547 |
| Red Hat OpenShift Container Platform 4.22 | Fixed | RHSA-2026:68553 |
| Red Hat Openshift Data Foundation 4.22 | Fixed | RHSA-2026:65130 |
| Red Hat Quay 3.14 | Fixed | RHSA-2026:70267 |
| Red Hat Quay 3.16 | Fixed | RHSA-2026:69255 |
| Red Hat Quay 3.17 | Fixed | RHSA-2026:74511 |
| Red Hat Quay 3.18 | Fixed | RHSA-2026:81110 |
| Red Hat Quay 3.9 | Fixed | RHSA-2026:65514 |
Not affected: 26 products
- Migration Toolkit for Applications 8
- Network Observability Operator
- OpenShift Pipelines
- OpenShift Serverless
- Red Hat AMQ Broker 7
- Red Hat Build of Podman Desktop
- Red Hat Data Grid 8
- Red Hat Developer Hub 1
- Red Hat Hardened Images
- Red Hat Migration Toolkit 1.8
- Red Hat OpenShift AI (RHOAI)
- Red Hat OpenShift AI 2.25
- Red Hat OpenShift AI 3.3
- Red Hat OpenShift AI 3.4
- Red Hat OpenShift Container Platform 4
- Red Hat OpenShift Container Platform 4.21
- Red Hat OpenShift Container Platform 4.22
- Red Hat OpenShift Container Platform 5
- Red Hat OpenShift Dev Spaces
- Red Hat Openshift Data Foundation 4.22
- Red Hat Quay 3.14
- Red Hat Quay 3.16
- Red Hat Quay 3.17
- Red Hat Quay 3.18
- Red Hat Quay 3.9
- Red Hat build of Apache Camel - HawtIO 4
Timeline
- 2026-10-02 Threatist record created from CVE-2026-16221
- 2026-10-03 Alias added: GHSA-v2hh-gcrm-f6hx
- 2026-10-07 Fix available: RHSA-2026:73987 · Red Hat
- 2026-10-13 Fix available: RHSA-2026:81110 · Red Hat
- 2026-10-13 Fix available: Red Hat Quay 3.18 · Red Hat
- 2026-10-20 Fix available: RHSA-2026:84734 · Red Hat
- 2026-10-20 Fix available: Red Hat OpenShift AI 3.4 · Red Hat
- 2026-10-22 Fix available: RHSA-2026:87410 · Red Hat
- 2026-10-23 Fix available: Red Hat OpenShift AI 2.25 · Red Hat
- 2026-10-27 Affected versions changed · Red Hat
- 2026-10-30 Fix available: RHSA-2026:92510 · Red Hat
- 2026-10-30 Affected versions changed · Red Hat
- 2026-10-30 Affected versions changed · Red Hat
References
Advisory 3
Other 7
- https://github.com/fastify/fast-uri/commit/0542a216860fd70c062a4730e620576f62ded057
- https://github.com/fastify/fast-uri/commit/2d50fbabc80e4d0884fe0f6a98fe118ce6faa353
- https://github.com/fastify/fast-uri/commit/9438266d6a7ded688c8bc7c4ba506da17f44a17b
- https://github.com/fastify/fast-uri
- https://github.com/fastify/fast-uri/releases/tag/v2.4.3
- https://github.com/fastify/fast-uri/releases/tag/v3.1.4
- https://github.com/fastify/fast-uri/releases/tag/v4.1.1
More Fast-uri vulnerabilities
- TI-2026-11539 fast-uri vulnerable to host confusion via failed IDN canonicalization CVSS 3.1HIGH 7.5
- TI-2026-05545 fast-uri vulnerable to path traversal via percent-encoded dot segments CVSS 3.1HIGH 7.5
- TI-2026-58005 fast-uri vulnerable to host confusion via an unclosed bracket in the URI authority CVSS 3.1HIGH 7.5
- TI-2026-53157 fast-uri vulnerable to host confusion via skipped IDN canonicalization on scheme-relative references CVSS 3.1HIGH 7.5
- TI-2026-15158 fast-uri vulnerable to host confusion via backslash authority introducer CVSS 3.1HIGH 7.5
- TI-2026-05546 fast-uri vulnerable to host confusion via percent-encoded authority delimiters CVSS 3.1HIGH 7.5
Sources
- CVE-2026-16221 · CVE Program
- CVE-2026-16221 · NVD
- FIRST EPSS
- GHSA-v2hh-gcrm-f6hx · GitHub Advisory Database · CC BY 4.0
- CVE-2026-16221 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences