Fast-uri fails to treat the character \\u005C (backslash) as an authority delimiter in URLs. The standard Node.JS WHATWG URL parser normalizes this character to a forward slash for special schemes such as http, https, ws, wss, ftp, and file, while fast-uri retains it as part of the host. When an application uses fast-uri to enforce host‑based policies—like allowlists, denylists, loopback checks, SSRF filtering, redirect validation, or outbound proxy routing—and then forwards the same URL to Node's native URL parser, fetch, undici, or HTTP clients, the two parsers resolve different hostnames. This host confusion can steer requests to unintended internal hosts or cloud metadata endpoints, enabling attackers to bypass security controls. The weakness is classified as CWE‑436.

The vulnerability affects fast-uri version 2.x up to 2.4.2, 3.x up to 3.1.3, and 4.x up to 4.1.0. The package can be identified as fast-uri:fast-uri in vendor listings. Patches are available in fast-uri 4.1.1, 3.1.4, and 2.4.3.

The CVSS score of 7.5 indicates a high severity, while the EPSS score of less than 1% suggests that exploitation is unlikely but still possible. The vulnerability is not listed in the CISA KEV catalog. The attack vector is likely an application or service that authorizes URLs using fast-uri for policy enforcement and then passes the same URL to standard Node.js URL consumers. Attackers could exploit this by crafting a URL containing a literal backslash to redirect traffic to a target host that bypasses the intended policy.