Tag
#Node.js
CVE-2026-16221: fast-uri Vulnerability Allows URL Parsing Discrepancies and Potential SSRF Attacks
A high-severity vulnerability (CVE-2026-16221, CVSS 7.5) exists in fast-uri versions 2.3.1 through 4.1.0, which can lead to URL parsing discrepancies when used with Node's native WHATWG URL parser. This discrepancy can be exploited to bypass host-based security policies, potentially allowing SSRF attacks or steering to unintended destinations, including cloud metadata endpoints or internal hosts. Affected applications should upgrade to fast-uri 4.1.1, 3.1.4, or 2.4.3 immediately.
Understanding and Defending Against CVE-2026-48615: Node.js Proxy Tunnel Credential Exposure
CVE-2026-48615 is a vulnerability in Node.js that exposes proxy credentials through error messages when proxy credentials are embedded in the proxy URL. This affects Node.js versions 22, 24, and 26. The vulnerability has a CVSS score of 7.5, indicating high severity. Understanding and mitigating this vulnerability is crucial to prevent potential credential exposure.