Celinke97

A signed integer overflow occurs in the `s2.NewDict()` function when a dictionary is supplied with a uvarint-encoded repeat value that exceeds `MaxInt64`. This allows an attacker to bypass repeat index validation. Subsequently, calling the `Dict.Encode()` function results in an out-of-bounds memory access via `unsafe.Pointer` arithmetic, leading to a process crash with SIGSEGV (a segmentation fault, which occurs when a program attempts to access a memory location it is not allowed to access).

The software fails to canonicalize Unicode Internationalized Domain Names (IDN) for HTTP-family URLs. This occurs because the IDN conversion path utilizes a helper missing from the global URL constructor, causing the host to remain in its original Unicode form. Consequently, the `normalize()` and `equal()` functions return values that differ from a WHATWG-compatible URL parser. This can lead to host confusion, allowing attackers to bypass host-based policies such as denylists, loopback filtering, redirect validation, or outbound proxy routing when the application uses fast-uri for validation but passes the URL to Node's URL or fetch for the actual request.

During smart-HTTP clone and fetch operations, the library may leak HTTP authentication credentials when following redirects. If a remote repository responds to the initial '/info/refs' request with a redirect to a different host, the session endpoint is updated to the redirected location and the original authentication, such as Authorization headers, is reused for subsequent requests. This allows an attacker controlling the redirect target to capture credentials and potentially access the victim's repositories or other resources. This issue occurs when interacting with untrusted or misconfigured Git servers or when using unsecured HTTP connections.