{
  "@id": "urn:uuid:c313b0a5-5df6-4a8b-aa3e-d207bdb6c395",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 2,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-10-06T12:51:00.262915+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/fast-uri@3.1.8",
          "identifiers": {
            "purl": "pkg:npm/fast-uri@3.1.8"
          }
        }
      ],
      "timestamp": "2026-10-06T12:51:00.262915+00:00",
      "status_notes": "Vulnerability CVE-2026-16221 does not affect version 3.1.8 of fast-uri. CVE-2026-16221 is not present in fast-uri v3.1.8. The vulnerability (literal backslash in URI authority causing host confusion between fast-uri and Node's WHATWG URL parser) was fixed by upstream maintainer Matteo Collina in commit 2d50fba, which was included in upstream release v3.1.5. The current version 3.1.8 inherited this fix from upstream. The fix rejects URIs containing literal backslash (U+005C) in the authority component as malformed, preventing the SSRF/redirect bypass attack where fast-uri would extract host \"allowed.com\" from \"http://evil.com\\@allowed.com\" while Node's URL parser would request \"evil.com\".",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-16221"
      },
      "impact_statement": "CVE-2026-16221 is not present in fast-uri v3.1.8. The vulnerability (literal backslash in URI authority causing host confusion between fast-uri and Node's WHATWG URL parser) was fixed by upstream maintainer Matteo Collina in commit 2d50fba, which was included in upstream release v3.1.5. The current version 3.1.8 inherited this fix from upstream. The fix rejects URIs containing literal backslash (U+005C) in the authority component as malformed, preventing the SSRF/redirect bypass attack where fast-uri would extract host \"allowed.com\" from \"http://evil.com\\@allowed.com\" while Node's URL parser would request \"evil.com\"."
    }
  ]
}