fast-uri versions from 2.3.1 through 3.1.2 and 4.0.0 do not correctly canonicalize Unicode (IDN) hostnames for HTTP-family URLs. The helper function called for IDN conversion is missing on the global URL constructor, leaving the host in its original Unicode form. As a result, the normalize() and equal() methods of fast-uri differ from a WHATWG-compatible URL parser. This host confusion allows attackers to craft URLs that resolve to different hosts under fast-uri and Node's native URL implementation. Applications that first enforce host-based policy using fast-uri before making an outbound request with Node's URL or fetch can be bypassed, potentially enabling SSRF or other malicious redirection attacks.

The affected product is fast-uri provided by the fast-uri project. Vulnerable versions are 2.3.1 through 3.1.2 inclusive and 4.0.0. Any application that relies on fast-uri for host validation, denylists, loopback filtering, redirect checks, or outbound proxy routing may unknowingly allow policy bypass.

The vulnerability has a CVSS score of 7.5, indicating high severity, but no EPSS score is available and it is not listed in the CISA KEV catalog. Attackers can exploit this weakness by supplying a crafted Unicode domain that fast-uri interprets differently from Node's native parser, thereby evading host-based restrictions imposed by the application. Exploitation requires network access to the vulnerable service and the ability to supply user-controlled URLs; once bypassed, the attacker could reach internal resources or redirect traffic to a malicious server.