504 matches found
GHSA-V2HH-GCRM-F6HX fast-uri vulnerable to host confusion via literal backslash authority delimiter
Impact fast-uri v4.1.0 and earlier do not treat a literal backslash U+005C as an authority delimiter. Node's native WHATWG URL used by fetch, undici, and Node's http/https clients normalizes \ to / for special schemes http, https, ws, wss, ftp, file, so the two parsers extract different hosts fro...