The vulnerability originates when fast‑uri parses a percent‑encoded scheme that contains slashes. During a legacy decoding pass the scheme is not re‑escaped and is later written verbatim during serialization. This causes a URI such as ‘percent%2Fencoded://example.com’ to be interpreted as a scheme with no authority, leaving the host and error fields undefined. When the URI is resolved or normalised the network‑path reference is generated with an attacker‑supplied authority derived from the percent‑encoded portion. Applications that rely on the parsed host for allowlist checks or assume that a URI lacking authority is safe can be tricked into redirecting the user, silently performing a server‑side request, or bypassing policy constraints. Additionally, the legacy decoder expands non‑standard escape sequences and allows control characters to appear in the scheme, potentially leading to injection issues.

The vulnerable component is the fast‑uri package used in Node.js projects. Versions 2.3.1 up to 2.4.4, 3.0.0 up to 3.1.5, and 4.0.0 up to 4.1.2 contain the flaw. Any application that depends on these releases is at risk.

The CVSS score of 7.5 indicates a high potential impact, while the EPSS score is < 1% and the advisory is not listed in CISA KEV. Attackers can exploit the flaw by supplying a crafted URI to a vulnerable application, prompting it to resolve or redirect to an attacker‑controlled host. The remedial action is to update the package, which removes the defect; until then, mitigation requires rigorous URI validation.