uri-js through 4.4.1 Denial of Service via removeDotSegments
Priority HIGH 77CWE-835Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Attack requirements
- None
- Impact type
- Denial of service
- Confidentiality · integrity · availability
- None · None · High
- Fix status
- Partial Red Hat: 1 fixed, 46 without a fix
Attack profile from CVSS 4.0 · CNA. Fix status from CNA and Red Hat. Impact type from CWE-835.
Summary
uri-js through 4.4.1 contains a denial of service vulnerability in the removeDotSegments function that loops infinitely when a path segment begins with Unicode line or paragraph separators. Attackers can trigger this by calling removeDotSegments directly or through normalize/resolve functions with IRI handling enabled, causing the Node.js event loop to block indefinitely until heap exhaustion.
Why it matters now
Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00451 39th percentileScored 2026-11-07
Fix Partial Red Hat: 1 advisoryRed Hat: 1 fixed, 46 without a fix
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- Poc
- Automatable
- Yes
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
Remediation
Red Hat 1 advisory
- RHSA-2026:92510 Released 2026-10-29 · Red Hat rating CriticalRHOAI 3.4.6 - Red Hat OpenShift AI
- Red Hat OpenShift AI 3.4 registry.redhat.io/rhoai/odh-built-in-detector-rhel9, registry.redhat.io/rhoai/odh-cli-rhel9, registry.redhat.io/rhoai/odh-dashboard-rhel9 +47
Vendor assessments
Red Hat
Red Hat rating: Important. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Ansible Automation Orchestrator 2026 | Affected | — |
| Cost Management On Premise | Affected | No fix yet |
| Gatekeeper 3 | Affected | — |
| Multicluster Engine for Kubernetes | Affected | No fix yet |
| Node HealthCheck Operator | Affected | No fix yet |
| OpenShift Lightspeed | Affected | No fix yet |
| OpenShift Pipelines | Affected | No fix yet |
| Red Hat 3scale API Management Platform 2 | Affected | — |
| Red Hat AMQ Broker 7 | Affected | — |
| Red Hat Advanced Cluster Management for Kubernetes 2 | Affected | No fix yet |
| Red Hat Ansible Automation Platform 2 | Affected | No fix yet |
| Red Hat Build of Keycloak | Affected | — |
| Red Hat Build of Podman Desktop | Affected | No fix yet |
| Red Hat Ceph Storage 4 | Affected | — |
| Red Hat Ceph Storage 9 | Affected | — |
| Red Hat Certification Program for Red Hat Enterprise Linux 9 | Affected | — |
| Red Hat Connectivity Link 1 | Affected | No fix yet |
| Red Hat Data Grid 8 | Affected | — |
| Red Hat Developer Hub 1 | Affected | No fix planned: Out of support scope |
| Red Hat Directory Server 11 | Affected | — |
| Red Hat Directory Server 12 | Affected | — |
| Red Hat Directory Server 13 | Affected | — |
| Red Hat Discovery 2 | Affected | No fix yet |
| Red Hat Edge Manager 1 | Affected | — |
| Red Hat Enterprise Linux 10 | Affected | — |
| Red Hat Enterprise Linux 7 | Affected | — |
| Red Hat Enterprise Linux 8 | Affected | — |
| Red Hat Enterprise Linux 9 | Affected | — |
| Red Hat Enterprise Linux AI (RHEL AI) 3 | Affected | No fix yet |
| Red Hat Fuse 7 | Affected | — |
| Red Hat Hardened Images | Affected | No fix yet |
| Red Hat JBoss Enterprise Application Platform 7 | Affected | — |
| Red Hat JBoss Enterprise Application Platform 8 | Affected | — |
| Red Hat JBoss Enterprise Application Platform Expansion Pack | Affected | — |
| Red Hat OpenShift AI (RHOAI) | Affected | No fix yet |
| Red Hat OpenShift Container Platform 4 | Affected | No fix yet |
| Red Hat OpenShift Container Platform 5 | Affected | No fix yet |
| Red Hat OpenShift Dev Spaces | Affected | No fix yet |
| Red Hat OpenShift GitOps | Affected | No fix planned: Out of support scope |
| Red Hat Openshift Data Foundation 4 | Affected | No fix yet |
| Red Hat Quay 3 | Affected | No fix yet |
| Red Hat Single Sign-On 7 | Affected | — |
| Red Hat build of Apache Camel - HawtIO 4 | Affected | — |
| Red Hat build of Apache Camel for Spring Boot 4 | Affected | — |
| Secrets Management Console for Red Hat OpenShift | Affected | No fix yet |
| Self-service automation portal 2 | Affected | — |
| Red Hat OpenShift AI 3.4 | Fixed | RHSA-2026:92510 |
Not affected: 7 products
- OpenShift Service Mesh 3
- Red Hat Enterprise Linux AI (RHEL AI) 3
- Red Hat Hardened Images
- Red Hat OpenShift AI 3.4
- Red Hat OpenShift Container Platform 4
- Red Hat OpenShift Container Platform 5
- Red Hat OpenShift Dev Spaces
Timeline
- 2026-10-02 Threatist record created from CVE-2026-93690
- 2026-10-03 Alias added: GHSA-ffpj-9hx9-929p
- 2026-10-15 Affected versions changed · Red Hat
- 2026-10-18 Affected versions changed · Red Hat
- 2026-10-20 Affected versions changed · Red Hat
- 2026-10-21 Affected versions changed · Red Hat
- 2026-10-23 EPSS moved to the below the 50th percentile
- 2026-10-27 Affected versions changed · Red Hat
- 2026-10-30 Fix available: RHSA-2026:92510 · Red Hat
- 2026-10-30 Fix available: Red Hat OpenShift AI 3.4 · Red Hat
- 2026-10-30 Affected versions changed · Red Hat
- 2026-10-30 Affected versions changed · Red Hat
- 2026-11-05 Affected versions changed · Red Hat
References
More garycourt vulnerabilities
- TI-2026-65678 garycourt uri-js Mailto Header mailto.ts URI.parse uncaught exception CVSS 4.0MEDIUM 5.3
- TI-2026-63117 uri-js through 4.4.1 Improper UTF-8 Decoding via pctDecChars CVSS 4.0MEDIUM 6.9
- TI-2017-11746 Uncontrolled resource consumption in HackerOne uri-js node module CVSS 3.1MEDIUM 6.5
Sources
- CVE-2026-93690 · CVE Program
- CVE-2026-93690 · NVD
- FIRST EPSS
- GHSA-ffpj-9hx9-929p · GitHub Advisory Database · CC BY 4.0
- CVE-2026-93690 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences