Zekth

The `normalize()` and `serialize()` functions incorrectly apply RFC 3986 dot-segment removal to the path of a relative-path reference. This algorithm is intended only for the merged target path during resolution. Consequently, a leading parent-directory segment may be dropped, causing a document-relative reference to become root-relative. Applications that normalize user-supplied relative references before resolution or use them as cache, deduplication, or authorization keys may allow the reference to escape its intended directory and access a different resource.

For HTTP-family schemes, the `canonicalizeHost()` function passes the parsed host to the WHATWG URL parser and adopts its hostname without verifying that the parser consumed the entire input as a host. This allows the authority to be silently rewritten by dropping data before an at-sign and stripping tab, carriage-return, and line-feed characters without reporting an error. Applications enforcing host-based policies, such as denylists, loopback filtering, redirect validation, or outbound proxy routing, may find that the canonical host diverges from the checked representation, potentially steering traffic to an unintended destination.

The software percent-decodes the scheme component using the legacy global `unescape()` function before validation. This allows inputs with percent-encoded schemes to be emitted as live schemes, contradicting RFC 3986. Applications that screen raw input for dangerous schemes but store or render the normalized result may inadvertently allow the creation of executable `javascript`, `data`, or `vbscript` URLs, leading to stored or reflected cross-site scripting. Additionally, the `equal()` function treats encoded and plain schemes as identical, which can be used to bypass equality-based allowlists.