fast-uri addresses two weaknesses:

CVE-2026-84394: A URL parsing and serialization flaws that can allow attackers to manipulate URL authority handling. Malformed authority brackets can cause parse().host to differ from Node URL resolution, potentially bypassing SSRF denylists, redirect allowlists, or proxy-routing controls. Affected versions: 2.4.5, 3.1.6, 4.1.3.

CVE-2026-84292: Non-digit port values are concatenated verbatim during serialize(), normalize(), and equal(), allowing authority delimiters to be injected and the constructed URL to redirect to an attacker-controlled host. Affected versions: =3.0.0 ,`