fast-uri incorrectly accepts host strings that contain an opening but no matching closing bracket. When such a host is parsed, the library returns the unclosed string as the host with no error notification, while Node’s URL processor and HTTP clients resolve the same string to a different endpoint. As a result, code that relies on the parsed host to enforce security policies will evaluate its rules against the wrong host value, potentially allowing attackers to target arbitrary internal or external systems through SSRF, open redirects, or proxy misdirection. The vulnerability aligns with the CWE-436 weakness of lack of input validation and is rated CVSS 7.5.

The affected product is fast-uri. Versions 2.4.5, 3.1.6, and 4.1.3 are vulnerable. Fixed releases are 2.4.6, 3.1.7, and 4.1.4.

The CVSS score of 7.5 indicates high severity. EPSS is not available, and the vulnerability is not listed in the CISA KEV catalog, suggesting no currently known public exploits. The likely attack vector is an application that uses fast-uri to parse user‑supplied URLs for host‑based filtering or routing decisions. An attacker can supply an unbalanced host to cause the library to accept the literal string, while the underlying HTTP request resolves to a different host, thereby bypassing security checks.