fast‑uri performs host canonicalization only when a scheme is present. For scheme‑relative references, the host is left unchanged, causing the parser’s various entry points to return divergent host values for the same input. An application that first extracts a host to check against a policy list and then resolves the same reference can make a decision based on one host while the request is delivered to another, enabling a host‑confusion attack and bypassing protection.

fast‑uri 2.4.2 through 2.4.4, 3.1.3 through 3.1.5, and 4.0.1 through 4.1.2 are affected. The issue was fixed in 2.4.5, 3.1.6, and 4.1.3, which apply consistent host canonicalization across all parsing paths.

The CVSS score of 7.5 indicates a high potential for damage. EPSS score of 0.247% indicates a low but non-zero exploitation probability, and the vulnerability is not listed in CISA KEV, suggesting a lower current exploitation likelihood. The flaw remains exploitable through crafted scheme‑relative URLs, and an attacker could exploit the mismatch between parse, resolve, normalize, and equal functions to redirect traffic or circumvent host‑based filtering.