fast‑uri percent‑decodes the scheme component with a legacy global function before validating it, allowing a percent‑encoded scheme to be interpreted as a legitimate one even though the standard forbids such encoding. This flaw lets an attacker craft a URL whose decoded scheme is a dangerous token (e.g., javascript, data, vbscript). If an application sanitizes the raw input for dangerous schemes but later uses the normalized result for storage or rendering, the attacker can turn a harmless string into an executable URL, producing a stored or reflected cross‑site scripting vector. The parsing logic also treats an encoded and a plain scheme as identical, enabling bypass of equality‑based allowlists.

The issue affects fast‑uri, a dependency‑free URI parser for Node.js. All releases prior to 2.4.8, 3.0.0 through 3.1.8, and 4.0.0 through 4.2.2 are vulnerable. The flaw is fixed in fast‑uri 2.4.8, 3.1.9, and 4.2.3 and later versions.

The CVSS score of 6.1 indicates moderate severity, and the EPSS of less than 1% suggests a low but non‑zero likelihood of exploitation. This vulnerability is not listed in CISA KEV. The typical attack scenario involves a web application that accepts user‑supplied URLs, sanitizes them for raw dangerous schemes, and then stores or renders the parsed result; an attacker can thus subvert the sanitization with a percent‑encoded scheme, resulting in XSS or bypassing allowlists.