--- id: CVE-2026-16221 title: >- fast-uri: Fast-uri: Security policy bypass due to URL parsing inconsistency (CVE-2026-16221) summary: >- A flaw was found in fast-uri. This vulnerability arises because fast-uri does not correctly interpret backslash characters as authority delimiters in Uniform Resource Locators (URLs), unlike Node.js's native WHATWG URL parser. This discrep… severity: high cvss: 7.5 cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N' cvssSource: vendor cwe: - CWE-807 - CWE-436 vendor: Red Hat product: Red Hat Openshift Data Foundation 4.22 affected: - openshift_lightspeed - openshift_serverless - enterprise_linux_ai_rhel_ai 3 - openshift_ai_rhoai - openshift_container_platform 4 - multicluster_engine_for_kubernetes - advanced_cluster_management_for_kubernetes 2 - amq_broker 7 - ansible_automation_platform 2 - build_of_apicurio_registry 3 - connectivity_link 1 - data_grid 8 - discovery 2 - edge_manager 1 - enterprise_linux 10 - enterprise_linux 8 - enterprise_linux 9 - satellite 6 - secrets_management_console_for_red_hat_openshift - self_service_automation_portal 2 - hardened_images - migration_toolkit 1.8 - openshift_container_platform 4.21 - openshift_container_platform 4.22 - openshift_data_foundation 4.22 - quay 3.14 - quay 3.16 - quay 3.9 patched: - hardened_images - migration_toolkit 1.8 - openshift_container_platform 4.21 - openshift_container_platform 4.22 - openshift_data_foundation 4.22 - quay 3.14 - quay 3.16 - quay 3.9 published: '2026-07-19' updated: '2026-09-22' sourceUpdated: '2026-09-22T17:59:35+00:00' source: CSAF sourceUrl: 'https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-16221.json' references: - url: >- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-16221.json - url: 'https://access.redhat.com/security/cve/CVE-2026-16221' - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2502307' - url: 'https://www.cve.org/CVERecord?id=CVE-2026-16221' - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-16221' - url: 'https://cna.openjsf.org/security-advisories.html' - url: >- https://github.com/fastify/fast-uri/security/advisories/GHSA-v2hh-gcrm-f6hx - url: 'https://access.redhat.com/errata/RHSA-2026:54518' - url: 'https://access.redhat.com/errata/RHSA-2026:54517' - url: 'https://access.redhat.com/errata/RHSA-2026:68681' - url: 'https://access.redhat.com/errata/RHSA-2026:68547' - url: 'https://access.redhat.com/errata/RHSA-2026:68553' - url: 'https://access.redhat.com/errata/RHSA-2026:65130' - url: 'https://access.redhat.com/errata/RHSA-2026:70267' - url: 'https://access.redhat.com/errata/RHSA-2026:69255' - url: 'https://access.redhat.com/errata/RHSA-2026:65514' - url: >- https://github.com/fastify/fast-uri/commit/0542a216860fd70c062a4730e620576f62ded057 - url: >- https://github.com/fastify/fast-uri/commit/2d50fbabc80e4d0884fe0f6a98fe118ce6faa353 - url: >- https://github.com/fastify/fast-uri/commit/9438266d6a7ded688c8bc7c4ba506da17f44a17b - url: 'https://github.com/fastify/fast-uri/releases/tag/v2.4.3' - url: 'https://github.com/fastify/fast-uri/releases/tag/v3.1.4' - url: 'https://github.com/fastify/fast-uri/releases/tag/v4.1.1' - url: 'https://github.com/advisories/GHSA-v2hh-gcrm-f6hx' tags: - csaf - vex - red-hat - ghsa - npm epss: 0.00254 epssPercentile: 0.15036 aliases: - GHSA-v2hh-gcrm-f6hx ecosystem: npm ingestedAt: '2026-07-21T22:55:08.324Z' --- ## Overview A flaw was found in fast-uri. This vulnerability arises because fast-uri does not correctly interpret backslash characters as authority delimiters in Uniform Resource Locators (URLs), unlike Node.js's native WHATWG URL parser. This discrepancy can cause applications that use fast-uri for security policy enforcement, such as allowlists or Server-Side Request Forgery (SSRF) filtering, to misidentify the intended host. Consequently, an attacker could bypass these security policies, potentially redirecting traffic to unintended internal or sensitive network destinations. ## Vendor advisories - **RHSA-2026:54518** · Red Hat · fixed in: Red Hat Hardened Images · released 2026-08-13 · [advisory](https://access.redhat.com/errata/RHSA-2026:54518) - **RHSA-2026:54517** · Red Hat · fixed in: Red Hat Hardened Images · released 2026-08-13 · [advisory](https://access.redhat.com/errata/RHSA-2026:54517) - **RHSA-2026:68681** · Red Hat · fixed in: Red Hat Migration Toolkit 1.8 · released 2026-09-17 · [advisory](https://access.redhat.com/errata/RHSA-2026:68681) - **RHSA-2026:68547** · Red Hat · fixed in: Red Hat OpenShift Container Platform 4.21 · released 2026-09-22 · [advisory](https://access.redhat.com/errata/RHSA-2026:68547) - **RHSA-2026:68553** · Red Hat · fixed in: Red Hat OpenShift Container Platform 4.22 · released 2026-09-22 · [advisory](https://access.redhat.com/errata/RHSA-2026:68553) - **RHSA-2026:65130** · Red Hat · fixed in: Red Hat Openshift Data Foundation 4.22 · released 2026-09-08 · [advisory](https://access.redhat.com/errata/RHSA-2026:65130) - **RHSA-2026:70267** · Red Hat · fixed in: Red Hat Quay 3.14 · released 2026-09-22 · [advisory](https://access.redhat.com/errata/RHSA-2026:70267) - **RHSA-2026:69255** · Red Hat · fixed in: Red Hat Quay 3.16 · released 2026-09-21 · [advisory](https://access.redhat.com/errata/RHSA-2026:69255) - **RHSA-2026:65514** · Red Hat · fixed in: Red Hat Quay 3.9 · released 2026-09-08 · [advisory](https://access.redhat.com/errata/RHSA-2026:65514) - **Red Hat VEX** · Important · affected: OpenShift Lightspeed, OpenShift Serverless, Red Hat Enterprise Linux AI (RHEL AI) 3, Red Hat OpenShift AI (RHOAI), Red Hat OpenShift Container Platform 4, Multicluster Engine for Kubernetes, … · no fix planned: OpenShift Lightspeed, OpenShift Serverless, Red Hat Enterprise Linux AI (RHEL AI) 3, Red Hat OpenShift AI (RHOAI), … · updated 2026-09-22 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-16221.json) **fast-uri: Fast-uri: Security policy bypass due to URL parsing inconsistency** — rated Important by Red Hat. Released 2026-07-19, updated 2026-09-22. Affected: - OpenShift Lightspeed - OpenShift Serverless - Red Hat Enterprise Linux AI (RHEL AI) 3 - Red Hat OpenShift AI (RHOAI) - Red Hat OpenShift Container Platform 4 - Multicluster Engine for Kubernetes - Red Hat Advanced Cluster Management for Kubernetes 2 - Red Hat AMQ Broker 7 - Red Hat Ansible Automation Platform 2 - Red Hat build of Apicurio Registry 3 - Red Hat Connectivity Link 1 - Red Hat Data Grid 8 - Red Hat Discovery 2 - Red Hat Edge Manager 1 - Red Hat Enterprise Linux 10 - Red Hat Enterprise Linux 8 - Red Hat Enterprise Linux 9 - Red Hat Satellite 6 - Secrets Management Console for Red Hat OpenShift - Self-service automation portal 2 Fixed: - Red Hat Hardened Images - Red Hat Migration Toolkit 1.8 - Red Hat OpenShift Container Platform 4.21 - Red Hat OpenShift Container Platform 4.22 - Red Hat Openshift Data Foundation 4.22 - Red Hat Quay 3.14 - Red Hat Quay 3.16 - Red Hat Quay 3.9 No fix planned: - OpenShift Lightspeed - OpenShift Serverless - Red Hat Enterprise Linux AI (RHEL AI) 3 - Red Hat OpenShift AI (RHOAI) - Red Hat OpenShift Container Platform 4 Not affected: - Red Hat Migration Toolkit 1.8 - Red Hat OpenShift Container Platform 4.21 - Red Hat OpenShift Container Platform 4.22 - Red Hat Openshift Data Foundation 4.22 - Red Hat Quay 3.14 - Red Hat Quay 3.16 - Red Hat Quay 3.9 - Migration Toolkit for Applications 8 - Network Observability Operator - OpenShift Pipelines ## Remediation For details on how to apply this update, which includes the changes described in this advisory, refer to: https://images.redhat.com/ https://access.redhat.com/errata/RHSA-2026:54518 For details on how to apply this update, which includes the changes described in this advisory, refer to: https://images.redhat.com/ https://access.redhat.com/errata/RHSA-2026:54517 Before applying this update, make sure all previously released errata relevant to your system have been applied. https://access.redhat.com/errata/RHSA-2026:68681 Workarounds / mitigations: - Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability. ## Package advisory (CVE-2026-16221) Affected packages: - `fast-uri >= 2.3.1, <= 2.4.2` - `fast-uri >= 3.0.0, <= 3.1.3` - `fast-uri >= 4.0.0, <= 4.1.0` Patched in: - `fast-uri 2.4.3` - `fast-uri 3.1.4` - `fast-uri 4.1.1` Source: https://github.com/advisories/GHSA-v2hh-gcrm-f6hx