fast-uri versions from 2.3.1 through 3.1.2 and 4.0.0 do not correctly canonicalize Unicode (IDN) hostnames for HTTP-family URLs. The helper function called for IDN conversion is missing on the global URL constructor, leaving the host in its original Unicode form. As a result, the normalize() and equal() methods of fast-uri differ from a WHATWG‑compatible URL parser. This host confusion allows attackers to craft URLs that resolve to different hosts under fast-uri and Node's native URL implementation.

The affected product is fast-uri provided by the fast-uri project. Vulnerable versions are 2.3.1 through 3.1.2 inclusive and 4.0.0. Any application that relies on fast-uri for host validation, denylists, loopback filtering, redirect checks, or outbound proxy routing may unknowingly allow policy bypass.

The vulnerability has a CVSS score of 7.5, indicating high severity, and the flaw corresponds to CWE-551 (IDN protocol) and CWE-436. No EPSS score is available, and it is not listed in the CISA KEV catalog. Attackers can exploit this weakness by supplying a crafted Unicode domain that fast‑uri interprets differently from Node's native parser, thereby evading host‑based restrictions imposed by the application. Exploitation requires network access to the vulnerable service and the ability to supply user‑controlled URLs; once bypassed, the attacker could reach internal resources or redirect traffic to a malicious server.