AIKIDO-2026-219652

TL;DR

fast-uri's serialize() writes an object's port value into the URI authority without checking that it only contains digits. A port value containing @ or another authority delimiter lets the rebuilt URI string address a different userinfo and host than the caller intended. An application that serializes a URI from user controlled port data can have that URI silently redirected to an attacker-chosen host. The fix rejects any non-numeric port value before serialization.