Host confusion via decoded scheme serialization

Host confusion in Fastify fast-uri allows remote attackers to steer URI resolution to an attacker-chosen authority via encoded schemes. Parsing decodes percent escapes in the scheme with legacy unescape(), while serialization writes the decoded scheme without validation or re-escaping, so an authority absent during parsing appears after normalize() or resolve(). Exposure requires a consuming application to process untrusted URIs and trust the initial host or authority result; consequences include off-site redirects, SSRF, address-policy bypass, or CRLF injection.