Skip to content
OpenAdvisories

Package · Debian

node-uri-js

3 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

3 results · Feed

  • Medium 4.3
    CVE-2026-103387

    garycourt uri-js Mailto Header mailto.ts URI.parse uncaught exception

    A weakness has been identified in garycourt uri-js up to 4.4.1. This affects the function URI.parse of the file src/schemes/mailto.ts of the component Mailto Header Handler. This manipulation of the argument to causes uncaught exception. The attack may be ini…

    garycourt uri-js node-uri-js node-uri-js Debian Ubuntu
  • Medium 6.5
    CVE-2026-93751

    uri-js through 4.4.1 Improper UTF-8 Decoding via pctDecChars

    uri-js through 4.4.1 contains an improper UTF-8 decoding vulnerability in pctDecChars() that decodes invalid and overlong percent-encoded sequences into ASCII metacharacters. Attackers can craft percent-encoded payloads to bypass platform decoder validation a…

    garycourt uri-js node-uri-js node-uri-js Debian Ubuntu
  • High 7.5
    CVE-2026-93690

    uri-js through 4.4.1 Denial of Service via removeDotSegments

    uri-js through 4.4.1 contains a denial of service vulnerability in the removeDotSegments function that loops infinitely when a path segment begins with Unicode line or paragraph separators. Attackers can trigger this by calling removeDotSegments directly or t…

    garycourt uri-js node-uri-js node-uri-js Debian Ubuntu