Description
fast-uri v4.1.1 and earlier require a literal // to recognize a URI authority, so a reference that uses \\, /\, or \/ as the authority introducer (in place of //, after an optional scheme) is parsed with no authority: the sequence and everything after it fold into the path.
Recommendation
Update the fast-uri package to the latest compatible version. Followings are version details:
Affected version(s): **>= 4.0.0, < 4.1.2 >= 3.0.0, < 3.1.5 < 2.4.4** Patched version(s): **4.1.2 3.1.5 2.4.4**
References
Could your website be exposed too?
SmartScanner can check your website for fast-uri vulnerable to host confusion via backslash authority introducer and gives you actionable findings to investigate.
Start a free scanRelated Issues
- fast-uri vulnerable to host confusion via literal backslash authority delimiter - CVE-2026-16221
- fast-uri vulnerable to host confusion via percent-encoded authority delimiters - CVE-2026-6322
- fast-uri vulnerable to host confusion via failed IDN canonicalization - CVE-2026-13676
- fast-uri vulnerable to path traversal via percent-encoded dot segments - CVE-2026-6321
You might also like:
See something that needs correcting? Let us knowUpdated August 03, 2026