CVE-2026-16221
Fixed in a distro release EPSS <1%CVSS 7.5
Impact: fast-uri versions from 2.3.1 through 4.1.0 (including the 3.x line up to 3.1.3 and the 2.x line up to 2.4.2) do not treat a literal backslash character (U+005C) as an authority delimiter. Node's native WHATWG URL parser, used by fetch, undici, and Node's http and https clients, normalizes the backslash to a forward slash for special schemes such as http, https, ws, wss, ftp, and file. As a result, the two parsers extract different hosts from the same input string. Applications that use fast-uri to enforce host-based policy such as allowlists, denylists, loopback or SSRF filtering, redirect validation, or outbound proxy routing before passing the same URL into Node's URL or fetch consumers can be steered to an unintended destination, including cloud metadata endpoints, loopback, or internal hosts. Patches: upgrade to fast-uri 4.1.1, 3.1.4, or 2.4.3. Workarounds: none.
Products: fast-uri
Fixed upstream
| Ecosystem | Package | Fixed in |
|---|---|---|
| npm | fast-uri | 2.4.3 |
| npm | fast-uri | 3.1.4 |
| npm | fast-uri | 4.1.1 |
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Chainguard | airflow-2 | no fix |
| Chainguard | airflow-core-2 | no fix |
| Chainguard | arangodb-3.12 | 3.12.9.4-r15 |
| Chainguard | argo-workflows-ui-3.7 | 3.7.17-r0 |
| Chainguard | argo-workflows-ui-4.0 | 4.0.8-r0 |
| Chainguard | argo-workflows-ui-4.0 | 4.0.11-r0 |
| Chainguard | commercial-gitlab-rails-ee-19.1 | 19.1.7-r3 |
| Chainguard | commercial-gitlab-rails-ee-19.2 | 19.2.7-r1 |
| Chainguard | commercial-gitlab-rails-ee-19.3 | 19.3.3-r1 |
| Chainguard | commercial-gitlab-rails-ee-fips-19.1 | 19.1.9-r0 |
| Chainguard | commercial-gitlab-rails-ee-fips-19.2 | 19.2.7-r1 |
| Chainguard | commercial-gitlab-rails-ee-fips-19.3 | 19.3.3-r1 |
| Chainguard | gemini-cli | 0.49.0-r6 |
| Chainguard | gitlab-rails-ce-18.1 | 18.1.6-r36 |
| Chainguard | gitlab-rails-ce-18.10 | no fix |
| Chainguard | gitlab-rails-ce-18.11 | 18.11.13-r0 |
| Chainguard | gitlab-rails-ce-18.6 | no fix |
| Chainguard | gitlab-rails-ce-18.7 | no fix |
| Chainguard | gitlab-rails-ce-18.8 | no fix |
| Chainguard | gitlab-rails-ce-18.9 | no fix |
| Chainguard | gitlab-rails-ce-19.0 | 19.0.9-r1 |
| Chainguard | gitlab-rails-ce-19.1 | 19.1.7-r4 |
| Chainguard | gitlab-rails-ce-19.2 | 19.2.5-r2 |
| Chainguard | gitlab-rails-ce-19.3 | 19.3.1-r6 |
| Chainguard | gitlab-rails-ce-fips-18.1 | no fix |
| Chainguard | gitlab-rails-ce-fips-18.10 | 18.10.8-r8 |
| Chainguard | gitlab-rails-ce-fips-18.11 | 18.11.12-r2 |
| Chainguard | gitlab-rails-ce-fips-18.6 | no fix |
| Chainguard | gitlab-rails-ce-fips-18.7 | no fix |
| Chainguard | gitlab-rails-ce-fips-18.8 | no fix |
| Chainguard | gitlab-rails-ce-fips-18.9 | 18.9.8-r8 |
| Chainguard | gitlab-rails-ce-fips-19.0 | 19.0.9-r3 |
| Chainguard | gitlab-rails-ce-fips-19.1 | 19.1.6-r5 |
| Chainguard | gitlab-rails-ce-fips-19.2 | 19.2.5-r2 |
| Chainguard | gitlab-rails-ce-fips-19.3 | 19.3.1-r3 |
| Chainguard | jupyter-base-notebook | 7.6.3-r2 |
| Chainguard | keep-ui | 0.54.2-r1 |
| Chainguard | keep-ui-fips | 0.54.2-r2 |
| Chainguard | kibana-8.19 | 8.19.18-r2 |
| Chainguard | kibana-8.19-bitnami | 8.19.18-r2 |
| Chainguard | kibana-8.19-iamguarded | 8.19.18-r2 |
| Chainguard | kibana-9.0 | 9.0.8-r34 |
| Chainguard | kibana-9.0-bitnami | 9.0.8-r34 |
| Chainguard | kibana-9.0-iamguarded | 9.0.8-r34 |
| Chainguard | kibana-9.1 | 9.1.10-r30 |
| Chainguard | kibana-9.1-iamguarded | 9.1.10-r30 |
| Chainguard | kibana-9.2 | 9.2.8-r17 |
| Chainguard | kibana-9.2-iamguarded | 9.2.8-r17 |
| Chainguard | langfuse-2 | 2.95.12-r35 |
| Chainguard | langfuse-2-worker | 2.95.12-r35 |
| Chainguard | langfuse-3 | 3.224.1-r0 |
| Chainguard | langfuse-3-compat | 3.225.7-r6 |
| Chainguard | langfuse-3-worker | 3.224.1-r0 |
| Chainguard | langfuse-fips-2 | 2.95.12-r38 |
| Chainguard | langfuse-fips-2-worker | 2.95.12-r38 |
| Chainguard | langfuse-fips-3 | 3.224.1-r0 |
| Chainguard | langfuse-fips-3-worker | 3.224.1-r0 |
| Chainguard | librechat | 0.8.7-r5 |
| Chainguard | nextcloud-server-34 | 34.0.2-r5 |
| Chainguard | opensearch-dashboards-2-dashboards-observability | 2.19.6-r8 |
| Chainguard | opensearch-dashboards-2-fips | 2.19.5-r18 |
| Chainguard | opensearch-dashboards-2-fips-alerting-dashboards-plugin | 2.19.5-r18 |
| Chainguard | opensearch-dashboards-2-fips-anomaly-detection-dashboards-plugin | 2.19.5-r18 |
| Chainguard | opensearch-dashboards-2-fips-dashboards-maps | 2.19.5-r18 |
| Chainguard | opensearch-dashboards-2-fips-dashboards-notifications | 2.19.5-r18 |
| Chainguard | opensearch-dashboards-2-fips-dashboards-observability | 2.19.5-r18 |
| Chainguard | opensearch-dashboards-2-fips-dashboards-query-workbench | 2.19.5-r18 |
| Chainguard | opensearch-dashboards-2-fips-dashboards-reporting | 2.19.5-r18 |
| Chainguard | opensearch-dashboards-2-fips-dashboards-search-relevance | 2.19.5-r18 |
| Chainguard | opensearch-dashboards-2-fips-dashboards-visualizations | 2.19.5-r18 |
| Chainguard | opensearch-dashboards-2-fips-index-management-dashboards-plugin | 2.19.5-r18 |
| Chainguard | opensearch-dashboards-2-fips-ml-commons-dashboards | 2.19.5-r18 |
| Chainguard | opensearch-dashboards-2-fips-security-analytics-dashboards-plugin | 2.19.5-r18 |
| Chainguard | opensearch-dashboards-2-fips-security-dashboards-plugin | 2.19.5-r18 |
| Chainguard | opensearch-dashboards-3 | 3.7.0-r11 |
| Chainguard | opensearch-dashboards-3-alerting-dashboards-plugin | 3.7.0-r7 |
| Chainguard | opensearch-dashboards-3-anomaly-detection-dashboards-plugin | 3.7.0-r7 |
| Chainguard | opensearch-dashboards-3-dashboards-maps | 3.7.0-r7 |
| Chainguard | opensearch-dashboards-3-dashboards-notifications | 3.7.0-r7 |
| Chainguard | opensearch-dashboards-3-dashboards-observability | 3.7.0-r7 |
| Chainguard | opensearch-dashboards-3-dashboards-query-workbench | 3.7.0-r7 |
| Chainguard | opensearch-dashboards-3-dashboards-reporting | 3.7.0-r7 |
| Chainguard | opensearch-dashboards-3-dashboards-search-relevance | 3.7.0-r7 |
| Chainguard | opensearch-dashboards-3-fips | 3.7.0-r17 |
| Chainguard | opensearch-dashboards-3-fips-alerting-dashboards-plugin | 3.7.0-r7 |
| Chainguard | opensearch-dashboards-3-fips-anomaly-detection-dashboards-plugin | 3.7.0-r7 |
| Chainguard | opensearch-dashboards-3-fips-dashboards-maps | 3.7.0-r7 |
| Chainguard | opensearch-dashboards-3-fips-dashboards-notifications | 3.7.0-r7 |
| Chainguard | opensearch-dashboards-3-fips-dashboards-observability | 3.7.0-r7 |
| Chainguard | opensearch-dashboards-3-fips-dashboards-query-workbench | 3.7.0-r7 |
| Chainguard | opensearch-dashboards-3-fips-dashboards-reporting | 3.7.0-r7 |
| Chainguard | opensearch-dashboards-3-fips-dashboards-search-relevance | 3.7.0-r7 |
| Chainguard | opensearch-dashboards-3-fips-index-management-dashboards-plugin | 3.7.0-r7 |
| Chainguard | opensearch-dashboards-3-fips-ml-commons-dashboards | 3.7.0-r7 |
| Chainguard | opensearch-dashboards-3-fips-security-analytics-dashboards-plugin | 3.7.0-r7 |
| Chainguard | opensearch-dashboards-3-fips-security-dashboards-plugin | 3.7.0-r7 |
| Chainguard | opensearch-dashboards-3-index-management-dashboards-plugin | 3.7.0-r7 |
| Chainguard | opensearch-dashboards-3-ml-commons-dashboards | 3.7.0-r7 |
| Chainguard | opensearch-dashboards-3-security-analytics-dashboards-plugin | 3.7.0-r7 |
| Chainguard | opensearch-dashboards-3-security-dashboards-plugin | 3.7.0-r7 |
| Chainguard | prism | 5.16.0-r4 |
| Chainguard | renovate | 44.3.2-r0 |
| Chainguard | renovate | 44.3.3-r0 |
| Chainguard | tensorflow-gpu-jupyter | 0 |
| Chainguard | tileserver-gl | 5.6.0-r10 |
| Chainguard | tileserver-gl-fips | 5.6.0-r9 |
| Chainguard | unleash | 8.0.3-r4 |
| Chainguard | unleash-fips | 8.0.3-r5 |
| Chainguard | unleash-proxy | 1.4.19-r2 |
| Chainguard | vitess-22 | 22.0.4-r24 |
| Chainguard | vitess-24 | 24.0.2-r7 |
| Chainguard | vitess-24-compat | 24.0.3-r7 |
| Chainguard | wazuh-dashboard | 4.14.6-r8 |
| Chainguard | wazuh-dashboard-fips | 4.14.6-r5 |
| Chainguard | wazuh-dashboard-security-plugin-fips | 4.14.6-r5 |
| Chainguard | yaml-language-server | 1.24.0-r1 |
| Debian 13 | node-ajv | no fix |
| Debian 14 | node-ajv | 8.20.0~ds+~cs7.1.2-1 |
| Red Hat hummingbird 1 | grafana12.4 | 0:12.4.8-0.1.1.hum1 |
| Red Hat hummingbird 1 | grafana13.1 | 0:13.1.3-0.1.1.hum1 |
| Ubuntu 18.04 LTS | node-ajv | no fix |
| Ubuntu 20.04 LTS | node-ajv | no fix |
| Ubuntu 22.04 LTS | node-ajv | no fix |
| Ubuntu 24.04 LTS | node-ajv | no fix |
| Ubuntu 26.04 LTS | node-ajv | no fix |
| Ubuntu 26.10 | node-ajv | no fix |
| Wolfi | argo-workflows-ui-3.7 | 3.7.17-r0 |
| Wolfi | argo-workflows-ui-4.0 | 4.0.8-r0 |
| Wolfi | argo-workflows-ui-4.0 | 4.0.11-r0 |
| Wolfi | jupyter-base-notebook | 7.6.3-r2 |
| Wolfi | langfuse-3 | 3.224.1-r0 |
| Wolfi | langfuse-3-compat | 3.225.7-r6 |
| Wolfi | langfuse-3-worker | 3.224.1-r0 |
| Wolfi | opensearch-dashboards-3 | 3.7.0-r11 |
| Wolfi | opensearch-dashboards-3-alerting-dashboards-plugin | 3.7.0-r7 |
| Wolfi | opensearch-dashboards-3-anomaly-detection-dashboards-plugin | 3.7.0-r7 |
| Wolfi | opensearch-dashboards-3-dashboards-maps | 3.7.0-r7 |
| Wolfi | opensearch-dashboards-3-dashboards-notifications | 3.7.0-r7 |
| Wolfi | opensearch-dashboards-3-dashboards-observability | 3.7.0-r7 |
| Wolfi | opensearch-dashboards-3-dashboards-query-workbench | 3.7.0-r7 |
| Wolfi | opensearch-dashboards-3-dashboards-reporting | 3.7.0-r7 |
| Wolfi | opensearch-dashboards-3-dashboards-search-relevance | 3.7.0-r7 |
| Wolfi | opensearch-dashboards-3-index-management-dashboards-plugin | 3.7.0-r7 |
| Wolfi | opensearch-dashboards-3-ml-commons-dashboards | 3.7.0-r7 |
| Wolfi | opensearch-dashboards-3-security-analytics-dashboards-plugin | 3.7.0-r7 |
| Wolfi | opensearch-dashboards-3-security-dashboards-plugin | 3.7.0-r7 |
| Wolfi | prism | 5.16.0-r4 |
| Wolfi | renovate | 44.3.2-r0 |
| Wolfi | renovate | 44.3.3-r0 |
| Wolfi | tileserver-gl | 5.6.0-r10 |
| Wolfi | vitess-24 | 24.0.2-r7 |
| Wolfi | vitess-24-compat | 24.0.3-r7 |
| Wolfi | yaml-language-server | 1.24.0-r1 |