GHSA-fph4-wmhf-6fwf fast-uri vulnerable to server-side request forgery via repeated hostname percent-decoding

• npm fast-uri: >= 2.4.1, < 2.4.5 → fixed in 2.4.5 • npm fast-uri: >= 3.1.2, < 3.1.6 → fixed in 3.1.6 • npm fast-uri: >= 4.0.0, < 4.1.3 → fixed in 4.1.3

Impact `fast-uri` decodes a hostname's percent escapes twice in a single `normalize()` or `resolve()` call: once during parsing and again during authority recomposition. A nested percent-encoded host therefore survives the first decode and is turned into a live destination by the second, so `normalize('http://%256c%256f%2563%2561%256c%2568%256f%2573%2574/')` returns `http://localhost/`. Applications that normalize or resolve an untrusted URI before an SSRF check, redirect validation, or host allowlist can be steered to a different destination, including internal addresses such as loopback or a cloud metadata endpoint, than the encoded input appeared to contain. This is an incomplete-fix variant of CVE-2026-6322, whose encoded-authority-delimiter fix introduced the second decode. Patches Fixed in `fast-uri` 2.4.5, 3.1.6, and 4.1.3. Workarounds Reject untrusted URIs whose host component contains an encoded percent sign (`%25`) before passing them to `normalize()` or `resolve()`.