fast-uri CVE-2026-6322

Update fast-uri to version 3.1.2 or later, which correctly handles percent-encoded authority delimiters without re-interpreting them as structural characters. For npm-based projects, run 'npm update fast-uri' or update package.json to specify '"fast-uri": "^3.1.2"' and reinstall dependencies. Vendor advisory at https://github.com/fastify/fast-uri/security/advisories/GHSA-v39h-62p7-jpjc confirms the fix. If immediate upgrade is not feasible, implement these compensating controls: (1) perform allowlist validation on raw URLs BEFORE normalization to prevent interpretation differences, (2) reject any URLs containing percent-encoded characters in the authority component (%40, %2F, %3A, %23, %3F) before passing to fast-uri, or (3) use alternative URL parsing libraries like Node.js native URL API for security-critical validation. Trade-off: Pre-normalization validation may reject some legitimate edge-case URLs but prevents parser confusion attacks. Do NOT rely solely on post-normalization validation for security decisions when using versions <=3.1.1.