CVE-2026-93751
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk14th percentile - higher than 14% of all known CVEs
Summary
uri-js through 4.4.1 contains an improper UTF-8 decoding vulnerability in pctDecChars() that decodes invalid and overlong percent-encoded sequences into ASCII metacharacters. Attackers can craft percent-encoded payloads to bypass platform decoder validation and inject path traversal or CRLF sequences that downstream consumers process without filtering.
Risk Assessment
The vulnerability allows bypassing validation mechanisms and injecting dangerous sequences into applications processing URIs, potentially leading to unauthorized file access or header manipulation. Organizations using uri-js in critical data processing paths are exposed to path traversal and CRLF injection attacks.
Recommendation
Update uri-js to a version newer than 4.4.1 if available, or apply additional input validation and sanitization before passing data to the decoder. Monitor the uri-js project security advisories for a fix.
Other vulnerabilities in uri-js
See all- CVE-2026-103387Medium
A weakness has been identified in garycourt uri-js up to 4.4.1. This affects the function URI.parse of the file src/schemes/mailto.ts of the component Mailto Header Handler. This manipulation of the argument to causes uncaught exception. The attack may be initiated remotely. The exploit has been made available to the public and could be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.
- CVE-2026-93690High
uri-js through 4.4.1 contains a denial of service vulnerability in the removeDotSegments function that loops infinitely when a path segment begins with Unicode line or paragraph separators. Attackers can trigger this by calling removeDotSegments directly or through normalize/resolve functions with IRI handling enabled, causing the Node.js event loop to block indefinitely until heap exhaustion.
Original NVD description (English source)
uri-js through 4.4.1 contains an improper UTF-8 decoding vulnerability in pctDecChars() that decodes invalid and overlong percent-encoded sequences into ASCII metacharacters. Attackers can craft percent-encoded payloads to bypass platform decoder validation and inject path traversal or CRLF sequences that downstream consumers process without filtering.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS