fast-uri’s normalize() function incorrectly handles percent‑encoded authority delimiters. When an encoded @ is present in the host portion, the library decodes it and then emits a raw @ during serialization, effectively changing the authority component to a second domain. Applications that use fast-uri to normalize untrusted URLs before performing hostname allowlisting, redirect checks, or routing outbound requests can be tricked into contacting a host that the user did not intend, leading to potential credential theft, phishing, or data exfiltration.

The issue affects the fast-uri library from the vendor fast-uri. Version numbers 3.1.1 and earlier contain the flaw. Versions 3.1.2 and higher contain the fix. Any project that includes fast-uri in its dependency tree is susceptible if it uses the normalize() call on content that originates outside the system.

The CVSS score of 7.5 indicates a high severity vulnerability; the EPSS is not available, and the issue is not listed in the CISA KEV catalog, suggesting no known widespread exploitation yet. The attack is remote and can be carried out by supplying a crafted URI, for instance via link shorteners, HTTP redirect responses, or API calls that accept URLs. Because the manipulation is performed before trust checks, an attacker could redirect requests to malicious domains while evading host allowlist restrictions.