Yashvanthange

**Name of the Vulnerable Software and Affected Versions** fast-uri versions prior to 2.4.6 fast-uri versions 3.0.0 through 3.1.6 fast-uri versions 4.0.0 through 4.1.3 **Description** The software serializes the port component of a URI without proper validation. During the recomposition of the authority, the port is concatenated verbatim while the userinfo and host components are escaped. This allows a port value containing non-digit characters to inject authority delimiters, which can demote the intended host to userinfo and redirect the authority to an attacker-controlled host. This issue occurs in applications that construct URIs from parts and assign untrusted data to the port component using the `serialize`, `normalize`, or `equal` functions in their object forms. **Recommendations** Update to version 2.4.6. Update to version 3.1.7. Update to version 4.1.4.

**Name of the Vulnerable Software and Affected Versions** fast-uri versions prior to 2.4.6 fast-uri versions prior to 3.1.7 fast-uri versions prior to 4.1.4 **Description** The `parse()` function fails to report an error when a host contains an unbalanced or misplaced authority bracket. A host starting with an opening bracket but lacking a closing bracket is not validated as an IP literal or canonicalized as a domain name. Consequently, the function returns the host with an undefined error, whereas Node's URL and associated HTTP clients resolve the string to a different host. This discrepancy can lead to host confusion in applications using the parsed host for security decisions, such as SSRF denylists, redirect allowlists, or proxy routing, as the policy is evaluated against a string different from the actual destination host. This behavior also persists through the `normalize`, `equal`, and `resolve` functions. **Recommendations** Update to version 2.4.6 or later. Update to version 3.1.7 or later. Update to version 4.1.4 or later.

**Name of the Vulnerable Software and Affected Versions** fast-uri versions 2.3.1 through 2.4.4 fast-uri versions 3.0.0 through 3.1.5 fast-uri versions 4.0.0 through 4.1.2 **Description** During URI parsing, the software performs a legacy decoding pass on the scheme component without re-escaping the result. When serialization occurs, the scheme is written verbatim. If an input scheme contains percent-encoded slashes, it is parsed as having no authority, leaving the host and error as undefined. However, resolving or normalizing this input produces a network-path reference with an attacker-controlled authority. This can lead to server-side request forgery, off-site redirects, or address-policy bypass if an application relies on the parsed host for allowlisting or assumes a reference without authority is safe. Additionally, the legacy decoder expands non-standard escape forms and allows control characters in the scheme to be output as raw carriage returns and line feeds. **Recommendations** Update fast-uri versions 2.3.1 through 2.4.4 to version 2.4.5. Update fast-uri versions 3.0.0 through 3.1.5 to version 3.1.6. Update fast-uri versions 4.0.0 through 4.1.2 to version 4.1.3.