Fast‑uri serializes the port component of a URI without validating it. When the authority is recomposed the port is concatenated verbatim, so a non‑numeric port can inject authority delimiters. This transforms the intended host into attacker‑controlled userinfo and directs the URI to an arbitrary host. The flaw is a classic example of unvalidated user input leading to injection (CWE‑116, CWE‑140).

The vulnerability exists in fast‑uri versions prior to 2.4.6, 3.1.7, and 4.1.4. Applications that build URIs from components—particularly those that use fast‑uri's serialize, normalize, or equal functions—are impacted. Node.js applications that rely on the URL module to parse the resulting URI also inherit the issue because they accept the malformed URL without error.

Fast‑uri has a high CVSS score of 7.5, indicating substantial impact if exploited. EPSS data is not available, and the vulnerability is not listed in the CISA KEV catalog, though the lack of a known exploit does not diminish potential risk. Attackers can leverage crafted URIs supplied to any vulnerable application, potentially manipulating end‑users to contact attacker‑controlled hosts or bypass authentication. The exploitation path requires only a malicious URI and does not need privileged access, making the threat realistic for public‑facing services that use fast‑uri.