fast-uri implements RFC 3986 URI parsing and uses the WHATWG URL parser to canonicalize the host component. In the affected releases, the canonicalizeHost() function accepts the parsed host from the WHATWG parser without verifying that the parser consumed the entire input as a host. This defect silently rewrites the authority: characters preceding an at‑sign are discarded, and tab, carriage‑return, and line‑feed characters are stripped, with no error reported. As a result, authentication or policy decisions that rely on a specific host representation can be subverted, allowing traffic to be steered to an unintended destination. The vulnerability does not provide arbitrary code execution but can compromise the confidentiality and integrity of data by enabling host‑based policy bypass.

fast-uri is a Node.js library that provides URI parsing. The issue affects the fast-uri npm package in all releases from 2.4.2 to 2.4.7, from 3.1.3 to 3.1.8, and from 4.0.1 to 4.2.2. Applications that depend on any of these versions for request validation, redirect handling, proxy configuration, or loopback protection are vulnerable. The fix is available in version 2.4.8, 3.1.9, and 4.2.3 and later.

The CVSS v3.1 score is 4.8 (Medium), and the EPSS score is below 1 %, indicating a low likelihood of widespread exploitation. The issue is not listed in CISA’s KEV catalog. Exploitation requires a crafted URL that is processed by the vulnerable implementation; the attack can be carried out by injecting or influencing URL values, resulting in silent host rewriting and traffic steering.