fast-uri versions >=2.3.1 <2.4.3, >=3.0.0 <3.1.4, and >=4.0.0 <4.1.1 fail to treat a literal backslash (U+005C) as an authority delimiter in URLs, unlike Node.js's native WHATWG URL parser which normalizes backslashes to forward slashes for special schemes (http, https, ws, wss, ftp, file). This discrepancy leads to host confusion where fast-uri and Node.js extract different hosts from the same URL input. For example, the URL 'http://evil.com\@allowed.com' is parsed by fast-uri as host 'allowed.com' with userinfo 'evil.com\', but Node.js treats it as host 'evil.com' with path '/@allowed.com'. Applications relying on fast-uri for host-based policy enforcement (allowlists, denylists, SSRF filtering, redirect validation, proxy routing) can be bypassed, allowing attackers to redirect requests to unintended destinations including internal or cloud metadata endpoints. The issue is addressed by upgrading to fast-uri versions 2.4.3, 3.1.4, or 4.1.1.

This vulnerability allows attackers to bypass host-based security policies enforced using fast-uri by exploiting differences in URL parsing between fast-uri and Node.js's native WHATWG URL parser. This can lead to unauthorized access or redirection to unintended hosts such as internal services or cloud metadata endpoints, potentially exposing sensitive information or enabling server-side request forgery (SSRF) attacks. The integrity of host validation and filtering mechanisms relying on fast-uri is compromised.

Upgrade fast-uri to version 2.4.3, 3.1.4, or 4.1.1 or later. No workarounds are available. Applying the official patch is the only recommended mitigation.