Description
URI.js (aka urijs) before 1.19.6 mishandles certain uses of backslash such as http:\/ and interprets the URI as a relative path.
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| npm | urijs | < 1.19.6 | 1.19.6 | GHSA-p6j9-7xhc-rhwp |
High · 7.5
CVE-2021-27516
EUVD-2021-0686GHSA-p6j9-7xhc-rhwp
URIjs Hostname spoofing via backslashes in URL
Published Feb 21, 2021 · Updated Aug 3, 2024 · Assigned by mitre