fast-uri vulnerable to host confusion via literal backslash authority delimiter

fast-uri's parse() and normalize() accept a literal backslash (\) as part of the host component rather than treating it as a delimiter. Node's built-in URL, browsers, and any WHATWG-compliant client normalize \ to / inside the authority. So a payload like http://trusted.example.com\@evil.tld/path is read by fast-uri as host=trusted.example.com\@evil.tld (or accepted as trusted.example.com depending on code path), while the downstream HTTP client that actually makes the request sees host=evil.tld. This is a classic parser differential — the same string means two different things to two different parsers in the same pipeline. Affected: fast-uri ≤ 3.1.1 (companion issue to CVE-2026-6321/6322); fixed in 3.1.2+.

The vendor's HIGH (7.5, C:N/I:H/A:N) reflects the correct impact class — this is an integrity bug, not RCE, not info disclosure of the parser itself. But calling it 7.5 flat undersells the *reach*: fast-uri is pulled transitively by ajv-formats → ajv → basically every JSON-schema-validating Node service on earth, plus Fastify's own request pipeline. On the other hand, it *oversells* the deterministic exploit rate: fast-uri has to be positioned as a security gate (SSRF allowlist, OAuth redirect_uri validator, webhook egress filter), not just a format check. Net: HIGH is fair. We hold it there.

Why this verdict

• Parser differential with a WHATWG-compliant downstream is the archetypal SSRF/open-redirect enabler — the Orange Tsai / Snyk research corpus documents this class ending in credential theft on major SaaS platforms every year.
• Supply-chain footprint: fast-uri is transitively pulled by ajv-formats which is pulled by ajv, which is present in a majority of Fastify, NestJS, and JSON-Schema-validating Node services. Blast radius is *broad*, even if per-app exploitability is conditional.
• Role multiplier — IdP / OAuth server: if fast-uri is validating redirect_uri in a self-hosted OIDC provider, the chain ends in authorization code interception. That is a fleet-scale identity outcome and floors the verdict at HIGH.
• Role multiplier — webhook / egress proxy: apps that let tenants register outbound webhook URLs and use fast-uri to enforce a host allowlist become SSRF pivots into the internal network. Same HIGH floor.
• Friction — conditional sink: apps that only use fast-uri for ajv format validation and never for allowlist decisions are unaffected in practice. This is why the verdict does not push to CRITICAL.
• Friction — no auth needed but no confidentiality impact at the parser itself. CVSS C:N/I:H/A:N is honest about the primitive; the confidentiality damage happens at whatever sink the SSRF hits.

Why not higher?

Not CRITICAL because exploitation requires a specific application pattern (validate-with-fast-uri, then forward original string to a WHATWG client) rather than being a drop-in RCE. There is no active exploitation, no KEV listing, and no confirmed mass-scanning campaign. The bug is an *enabler* of downstream attacks, not the terminal impact on its own.

Why not lower?

Not MEDIUM because the deployment footprint is enormous (transitive dep of ajv-formats), the exploit is pre-auth and network-reachable, and the plausible chain terminates in OAuth code theft or internal SSRF on identity-role deployments. Parser-differential bugs in ubiquitous URL parsers have a long history of ending in real breaches, and treating this as MEDIUM would ignore that base rate.

1. Bump fast-uri to ≥ 3.1.2 across all lockfiles — This is the actual fix. Run npm ls fast-uri / pnpm why fast-uri / yarn why fast-uri in every repo, then use overrides (npm overrides, pnpm.overrides, yarn resolutions) to force ≥3.1.2 even when transitive. Deploy within the noisgate HIGH mitigation window (30 days).
2. Reject backslash characters at the ingress layer — Add a WAF rule or middleware check that 400s any request whose URL/JSON body fields matching format: uri contain a raw \ in the authority portion. Cheap belt-and-braces while the dep bump rolls through CI.
3. Reserialize URLs with Node's built-in URL before any host allowlist check — Never trust fastUri.parse(x).host for an allowlist decision. Do new URL(x).host (WHATWG) and compare that. This makes you resilient to *this* CVE and the entire parser-differential class.
4. Egress deny-by-default from any service that fetches user-supplied URLs — Squid/Envoy/Zscaler with a strict per-service allowlist blocks the SSRF terminal step even if the URL check is bypassed. If you already have this, this CVE drops to a redirect/webhook nuisance.
5. For IdPs and OAuth clients: enforce exact-match redirect_uri and PKCE — Wildcard/prefix matching on redirect_uri is where this bug becomes an account takeover. Move to exact-match now regardless of whether you're on fast-uri.

Run on any developer workstation or CI runner from the root of a Node repo. Invoke as ./check-fast-uri.sh /path/to/repo (defaults to .). No elevated privileges required — needs npm or pnpm on PATH.

#!/usr/bin/env bash
# noisgate check for CVE-2026-16221 (fast-uri backslash host confusion)
# VULNERABLE : fast-uri <= 3.1.1 present in resolved tree
# PATCHED    : fast-uri >= 3.1.2 only
# UNKNOWN    : no lockfile / no Node project detected
set -u
ROOT="${1:-.}"
cd "$ROOT" 2>/dev/null || { echo "UNKNOWN: cannot cd to $ROOT"; exit 2; }

HAS_PKG=0
[ -f package.json ] && HAS_PKG=1
if [ "$HAS_PKG" -eq 0 ]; then
  echo "UNKNOWN: no package.json at $ROOT"
  exit 2
fi

# Try npm ls first, then pnpm, then yarn
VERSIONS=""
if command -v npm >/dev/null 2>&1; then
  VERSIONS=$(npm ls fast-uri --all --parseable --long 2>/dev/null | awk -F: '{print $2}' | grep -Eo 'fast-uri@[0-9]+\.[0-9]+\.[0-9]+' | sort -u)
fi
if [ -z "$VERSIONS" ] && command -v pnpm >/dev/null 2>&1; then
  VERSIONS=$(pnpm why fast-uri --json 2>/dev/null | grep -Eo '"fast-uri"[^}]*"version"[^,]*' | grep -Eo '[0-9]+\.[0-9]+\.[0-9]+' | sort -u | sed 's/^/fast-uri@/')
fi
if [ -z "$VERSIONS" ] && [ -f package-lock.json ]; then
  VERSIONS=$(grep -Eo '"fast-uri"\s*:\s*\{[^}]*"version"\s*:\s*"[0-9.]+"' package-lock.json | grep -Eo '[0-9]+\.[0-9]+\.[0-9]+' | sort -u | sed 's/^/fast-uri@/')
fi

if [ -z "$VERSIONS" ]; then
  echo "PATCHED: fast-uri not present in resolved dependency tree"
  exit 0
fi

VULN=0
while IFS= read -r line; do
  V=$(echo "$line" | sed 's/^fast-uri@//')
  MAJ=$(echo "$V" | cut -d. -f1)
  MIN=$(echo "$V" | cut -d. -f2)
  PAT=$(echo "$V" | cut -d. -f3)
  # Vulnerable: any 3.x <= 3.1.1, or any older major
  if [ "$MAJ" -lt 3 ]; then VULN=1; echo "  found $line (VULNERABLE)"; continue; fi
  if [ "$MAJ" -eq 3 ] && [ "$MIN" -eq 0 ]; then VULN=1; echo "  found $line (VULNERABLE)"; continue; fi
  if [ "$MAJ" -eq 3 ] && [ "$MIN" -eq 1 ] && [ "$PAT" -lt 2 ]; then VULN=1; echo "  found $line (VULNERABLE)"; continue; fi
  echo "  found $line (patched)"
done <<< "$VERSIONS"

if [ "$VULN" -eq 1 ]; then
  echo "VULNERABLE: fast-uri <= 3.1.1 present. Bump to >= 3.1.2 via package overrides."
  exit 1
fi
echo "PATCHED: all resolved fast-uri versions >= 3.1.2"
exit 0

Sources

1. GHSA-v39h-62p7-jpjc — fast-uri host confusion advisory (sibling CVE-2026-6322)
2. GitHub Advisory Database — CVE-2026-6322
3. GitLab GLAD — fast-uri CVE-2026-6322
4. GitLab GLAD — fast-uri CVE-2026-6321 (path traversal companion)
5. Eventus Security — fast-uri path traversal and host confusion writeup
6. GHSA-4c8g-83qw-93j6 — fast-uri IDN canonicalization variant
7. gh-aw-firewall issue tracking fast-uri advisory cluster
8. Guzzle PSR-7 — parallel host confusion via authority reinterpretation (class reference)