Interpretation Conflict in fast-uri - CVE-2026-16221

Vulnerability identifier: #VU139081

CSH Severity: Medium

CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2026-16221

CWE-ID: CWE-436

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to bypass host-based policy checks and route requests to an unintended destination.

The vulnerability exists due to interpretation conflict in the fast-uri URL parser when parsing URLs containing a literal backslash in the authority section for special schemes. A remote attacker can supply a specially crafted URL to bypass host-based policy checks and route requests to an unintended destination.

This issue can occur when an application validates a URL with fast-uri and then passes the same input to Node's WHATWG URL parser or fetch-related consumers, which extract a different host from the same string.

fast-uri
Event Processing
webMethods API Gateway
Data Cataloging
QRadar Threat Intelligence
IBM Fusion HCI
Bitbucket Data Center
Bamboo Data Center
Jira Software Data Center
Jira Service Management Data Center
Informix Dynamic Server

Install security update from vendor's website.

fast-uri - addressed in versions 2.4.3, 3.1.4, 4.1.1
Event Processing - update to 1.5.5
IBM Fusion HCI - update to 2.14.0
Bitbucket Data Center - update to 9.4.23
Bamboo Data Center - update to 10.2.22
Jira Software Data Center - addressed in versions 10.3.25, 11.3.1
Jira Service Management Data Center - addressed in versions 10.3.25, 11.3.1
webMethods API Gateway - update to 11.1 Fix13
Data Cataloging - update to 2.5.6
QRadar Threat Intelligence - update to 2.6.0
Informix Dynamic Server - addressed in versions 14.10.FC14W1, 15.0.1.16

• https://github.com/fastify/fast-uri/security/advisories/GHSA-v2hh-gcrm-f6hx

• Interpretation Conflict in fast-uri
• Multiple vulnerabilities in Bamboo Data Center
• Multiple vulnerabilities in Bitbucket Data Center
• Multiple vulnerabilities in IBM Informix Dynamic Server
• Multiple vulnerabilities in Jira Service Management Data Center
• Multiple vulnerabilities in Jira Software Data Center
• Multiple vulnerabilities in IBM Event Processing
• Multiple vulnerabilities in IBM QRadar Threat Intelligence
• Multiple vulnerabilities in IBM webMethods API Gateway
• Multiple vulnerabilities in IBM Fusion, IBM Fusion HCI, and IBM Fusion Data Cataloging