Read the docs
TI-2020-16112 Aliases CVE-2020-26291GHSA-3329-pjwv-fjpg

Hostname spoofing in URI.js

Priority LOW 32CWE-20Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
None · High · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA, GitHub and Red Hat.

Summary

URI.js is a javascript URL mutation library (npm package urijs). In URI.js before version 1.19.4, the hostname can be spoofed by using a backslash (`\`) character followed by an at (`@`) character. If the hostname is used in security decisions, the decision may be incorrect. Depending on library usage and attacker intent, impacts may include allow/block list bypasses, SSRF attacks, open redirects, or other undesired behavior. For example the URL `https://expected-example.com\@observed-example.com` will incorrectly return `observed-example.com` if using an affected version. Patched versions correctly return `expected-example.com`. Patched versions match the behavior of other parsers which implement the WHATWG URL specification, including web browsers and Node's built-in URL class. Version 1.19.4 is patched against all known payload variants. Version 1.19.3 has a partial patch but is still vulnerable to a payload variant.]

Why it matters now

EPSS 0.0171 77th percentileScored 2026-11-07
Fix Fixed URI.js (medialize): 1.19.4urijs (npm): 1.19.4Red Hat: 1 advisory

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
medializeURI.jsbefore 1.19.41.19.4Patch availableCNA
—urijs (npm)before 1.19.41.19.4Patch availableGHSA-3329-pjwv-fjpg
  • URI.js Vendormedialize Affected before 1.19.4 Fixed in 1.19.4 Patch available CNA
  • urijs (npm) Vendor— Affected before 1.19.4 Fixed in 1.19.4 Patch available GHSA-3329-pjwv-fjpg

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:uri.js_project:uri.js:*:*:*:*:*:*:*:*before 1.19.4Vulnerablemedialize
  • cpe:2.3:a:uri.js_project:uri.js:*:*:*:*:*:*:*:* Versions before 1.19.4 Vulnerable ·medialize

Remediation

  • Fix · CNA URI.js (medialize) Fixed in 1.19.4
  • Fix · GHSA-3329-pjwv-fjpg urijs (npm) Fixed in 1.19.4 Advisory →

Red Hat 1 advisory

  • RHSA-2021:3917 Released 2021-10-19 · Red Hat rating Important
    Red Hat Quay v3.6.0 security, bug fix and enhancement update
    • Quay v3 quay/quay-rhel8

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
Quay v3Fixed RHSA-2021:3917
Not affected: 1 product
  • Quay v3

Timeline

  1. 2026-10-02 Threatist record created from CVE-2020-26291
  2. 2026-10-03 Alias added: GHSA-3329-pjwv-fjpg

References

Patch 1

Advisory 4

Other 2

  • TI-2022-08538 Improper Input Validation in URI.js CVSS 3.1MEDIUM 5.3
  • TI-2021-08996 URI.js (aka urijs) before 1.19.6 mishandles certain uses of backslash such as http:\/ and… CVSS 3.1HIGH 7.5
  • TI-2022-00530 Authorization Bypass Through User-Controlled Key in medialize/uri.js CVSS 3.1MEDIUM 6.5
  • TI-2022-01120 URL Confusion When Scheme Not Supplied in medialize/uri.js CVSS 3.1MEDIUM 6.1
  • TI-2021-02592 Open Redirect in medialize/URI.js CVSS 3.1MEDIUM 6.1
  • TI-2022-01130 CRHTLF can lead to invalid protocol extraction potentially leading to XSS in medialize/uri.js CVSS 3.1MEDIUM 6.1
See all 7 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences