The fast-uri library versions before 2.4.4, between 3.0.0 and 3.1.5, and between 4.0.0 and 4.1.2 have a vulnerability where they require a literal '//' to recognize a URI authority. If a URI uses backslash sequences (\\, /\, \/) instead of '//', fast-uri fails to parse the authority and treats the sequence and everything after it as part of the path. In contrast, Node's WHATWG URL parser treats '\\' as equivalent to '/' for certain schemes (http, https, ws, wss, ftp, file), extracting a different host. This mismatch can cause applications that rely on fast-uri for host-based policy enforcement to be bypassed when the same URL is later processed by Node's URL or fetch consumers, potentially redirecting to unintended hosts. The issue is fixed in fast-uri versions 2.4.4, 3.1.5, and 4.1.2.

This vulnerability allows attackers to bypass host-based security controls that rely on fast-uri for URI parsing. Because fast-uri and Node's WHATWG URL parser interpret backslash sequences differently, an attacker can craft URLs that appear safe to fast-uri but resolve to malicious hosts when processed by Node's native URL parser. This can lead to security policy bypasses such as SSRF, unauthorized redirects, or proxy routing to unintended destinations. There is no indication of known exploits in the wild at this time.

Upgrade fast-uri to version 2.4.4, 3.1.5, or 4.1.2 or later. No workarounds are available. Applying the official patch is the only effective mitigation.