fast‑uri prior to 4.1.2, 3.1.5, and 2.4.4 parses URI authority only when a literal double forward slash is present. A backslash‑based introducer causes the parser to ignore the authority part and treat the string as a path. Node's native WHATWG URL parser treats backslashes as forward slashes for special schemes, extracting a host where fast‑uri does not. Applications that enforce host‑based rules with fast‑uri before passing the same URL to Node or fetch can therefore be tricked into reaching an unintended host, enabling SSRF or redirect bypass.

The issue affects any use of the fast‑uri library before the specified releases. Versions earlier than 4.1.2, 3.1.5, or 2.4.4 are vulnerable. Applications that import fast‑uri for URL validation, authority extraction, or whitelist enforcement are impacted.

The CVSS score of 7.5 denotes moderate to high severity, while the EPSS of less than 1% suggests a low current exploitation probability; the vulnerability is not listed in the CISA KEV catalog. Despite the low EPSS, the attack vector is straightforward: an attacker who can influence input URLs can craft a backslash‑based authority introducer that the application accepts as valid and then redirects or SSRF to an unintended host. The risk is therefore primarily dependent on the existence of the vulnerable library and on the application's reliance on fast‑uri for host decisions.