{
  "@id": "urn:uuid:e50cac4b-70ea-45f1-ae55-398f3ddf146b",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 4,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-10-06T12:51:00.262915+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/fast-uri@3.1.7",
          "identifiers": {
            "purl": "pkg:npm/fast-uri@3.1.7"
          }
        }
      ],
      "timestamp": "2026-10-06T12:51:00.262915+00:00",
      "status_notes": "Vulnerability CVE-2026-16221 does not affect version 3.1.7 of fast-uri. The target fast-uri v3.1.7 is NOT AFFECTED by CVE-2026-16221. The upstream vendor (Matteo Collina) already fixed this URL parser desync vulnerability in the v3.1.4 release, which is included in the target version. The fix (commit 2d50fba) is present in index.js at lines 422-426, where it rejects URIs containing literal backslashes in the authority component with the error \"URI authority must not contain a literal backslash.\" This prevents the parser desync where fast-uri would extract a different host than Node's WHATWG URL parser. The fix is confirmed by regression tests in test/security.test.js that verify all CVE-described attack inputs are rejected.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-16221"
      },
      "impact_statement": "The target fast-uri v3.1.7 is NOT AFFECTED by CVE-2026-16221. The upstream vendor (Matteo Collina) already fixed this URL parser desync vulnerability in the v3.1.4 release, which is included in the target version. The fix (commit 2d50fba) is present in index.js at lines 422-426, where it rejects URIs containing literal backslashes in the authority component with the error \"URI authority must not contain a literal backslash.\" This prevents the parser desync where fast-uri would extract a different host than Node's WHATWG URL parser. The fix is confirmed by regression tests in test/security.test.js that verify all CVE-described attack inputs are rejected."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/fast-uri@3.1.7",
          "identifiers": {
            "purl": "pkg:npm/fast-uri@3.1.7"
          }
        }
      ],
      "timestamp": "2026-10-01T11:11:44.028700+00:00",
      "status_notes": "Vulnerability CVE-2026-86472 affects version 3.1.7 of fast-uri, and is fixed in 3.1.7-tuxcare.1.",
      "vulnerability": {
        "name": "CVE-2026-86472"
      },
      "action_statement": "Vulnerability CVE-2026-86472 affects version 3.1.7 of fast-uri, and is fixed in 3.1.7-tuxcare.1."
    }
  ]
}