[GHSA] GHSA-jqff-g426-hqxp (high) — fast-uri vulnerable to host confusion via percent-encoded scheme normalization

GHSA-jqff-g426-hqxp Severity: high CVE: CVE-2026-76172

fast-uri vulnerable to host confusion via percent-encoded scheme normalization

### Impact

`fast-uri` decodes percent-encoded characters in the scheme component with the legacy global `unescape()` and serializes the result back as raw characters, without re-escaping it or validating it as a scheme. A scheme that decodes to characters outside