Baeseungwon1010

**Name of the Vulnerable Software and Affected Versions** fast-uri versions 2.4.2 through 2.4.4 fast-uri versions 3.1.3 through 3.1.5 fast-uri versions 4.0.1 through 4.1.2 **Description** fast-uri, a URI parser for Node.js, fails to consistently canonicalize hosts to ASCII form when processing scheme-relative references (references where the host is preceded by two slashes without an explicit scheme). This inconsistency causes the `parse()`, `resolve()`, `normalize()`, and `equal()` functions to yield different results for the same input. An application using these functions to validate a host against a policy list before resolving the reference may make a decision based on one host while the actual destination is another, leading to host confusion and policy bypass. IDN canonicalization refers to the process of converting Internationalized Domain Names into a standardized ASCII format known as Punycode. **Recommendations** Update versions 2.4.2 through 2.4.4 to 2.4.5. Update versions 3.1.3 through 3.1.5 to 3.1.6. Update versions 4.0.1 through 4.1.2 to 4.1.3.