fast‑uri is a Node.js URI parsing library that performs percent‑decoding at two separate stages: during hostname parsing and later when reconstructing the authority component. The double decoding means a single percent‑encoded value can be transformed into a different network destination in one operation. The result is that a crafted HTTP‑family URI can resolve to an unintended host, such as a loopback address, allowing an attacker to send requests to internal services or bypass host‑policy checks, thereby enabling server‑side request forgery.

Fast‑uri releases 2.4.1 through 2.4.4, 3.1.2 through 3.1.5, and 4.0.0 through 4.1.2 are vulnerable. The issue is fixed in 2.4.5, 3.1.6, and 4.1.3, which perform a single percent‑decode and retain encoded percent signs.

The CVSS score of 7.5 indicates a high severity rating, and the vulnerability is not listed in the CISA KEV catalog. The EPSS score is 0.00234 (0.234%), indicating a very low exploitation probability. It is inferred that no authentication is required, as the double‑decoding occurs during normal URI normalization, and the main attack vector is a crafted URI supplied by an external source. Applications that normalize or resolve untrusted URIs before outbound routing or host‑policy verification can unknowingly route to forbidden destinations, such as localhost or internal IP ranges. The risk is amplified for services exposed to the Internet, where an attacker can reach internal networks, potentially leading to data exfiltration or privilege escalation.