fix: backport GHSA-q3j6-qgpj-74h6 and GHSA-v39h-62p7-jpjc to v2.x

[mcollina]

Summary

Backports the security fixes for:

• GHSA-q3j6-qgpj-74h6 / CVE-2026-6321 — path traversal via percent-encoded dot segments (%2E%2E, %2F)
• GHSA-v39h-62p7-jpjc / CVE-2026-6322 — host confusion via percent-encoded authority delimiters (%40, %3A, …)

These were originally fixed in v3.1.1 and v3.1.2. The v2.x line (<= 2.4.0) is still vulnerable.

Changes

• Preserve reserved path escapes during parse / normalize / equal / serialize so encoded separators and dot segments stay data, not live path syntax
• Re-escape RFC 3986 gen-delims in the host after unescape() so authority structure cannot be rewritten
• Report malformed authority/port via error; leave such string inputs unchanged in normalize(); return false from equal() when either side is malformed
• Add regression tests covering both advisories

Follow-up

After merge, publish a 2.4.1 (or next patch) and update both GHSAs to list the new 2.x patched version alongside 3.1.1 / 3.1.2.

Test plan

• npm run test:unit (includes new security regression tests)
• npm run test:lint
• Manual checks:
  • normalize('http://example.com/public/%2e%2e/admin') → keeps %2E%2E
  • equal(...%2e%2e/admin, .../admin) → false
  • normalize('http://trusted.com%40evil.com/') → preserves %40
  • parse('http://trusted.com%40evil.com/').host → trusted.com%40evil.com

[mcollina]

@UlisesGascon would you take care of updating the OpenJS records once this lands?

[mcollina]

Unfortunately, I have v2 of fast-uri in the dependency tree :(. Sigh.

[ivan-tymoshenko]

lgtm