A vulnerability in the fast-uri JavaScript library allows malformed URI hosts containing unbalanced or misplaced authority brackets to bypass host validation logic. The parse() function returns such hosts without reporting an error, while Node.js URL and HTTP clients built on it resolve the same string to a different host. This discrepancy can be exploited to bypass SSRF denylists, redirect allowlists, or proxy routing rules, as the application evaluates security policy against a different string than the one actually used in the HTTP request. The flaw also propagates through normalize(), equal(), and resolve() functions. Affected versions include fast-uri 2.4.5, 3.1.6, and 4.1.3, and fixes are available in 2.4.6, 3.1.7, and 4.1.4 respectively. The fix ensures parse() reports a malformed host error for any host containing a bracket that is not a valid IPv6 literal.
