Vulnerabilities

TI-2026-65678 CVE-2026-103387 · GHSA-cw9r-3wqp-32hm

garycourt uri-js Mailto Header mailto.ts URI.parse uncaught exception

MEDIUM 57

A weakness has been identified in garycourt uri-js up to 4.4.1.

CVSS 4.0MEDIUM 5.3 Network No auth User interaction EPSS 0.00319 Published 2026-09-30 No fix listed CWE-248

TI-2026-63117 CVE-2026-93751 · GHSA-7g43-p94j-qr58

uri-js through 4.4.1 Improper UTF-8 Decoding via pctDecChars

LOW 37

uri-js through 4.4.1 contains an improper UTF-8 decoding vulnerability in pctDecChars() that decodes invalid and overlong percent-encoded sequences into ASCII metacharacters.

CVSS 4.0MEDIUM 6.9 Network No auth No interaction EPSS 0.004 Published 2026-09-18 No fix listed CWE-176

TI-2026-63101 CVE-2026-93690 · GHSA-ffpj-9hx9-929p

uri-js through 4.4.1 Denial of Service via removeDotSegments

HIGH 77

uri-js through 4.4.1 contains a denial of service vulnerability in the removeDotSegments function that loops infinitely when a path segment begins with Unicode line or paragraph separators.

CVSS 4.0HIGH 8.7 Network No auth No interaction EPSS 0.00451 Published 2026-09-18 Partial fix CWE-835

TI-2017-11746 CVE-2017-16021 · GHSA-333w-rxj3-f55r

Uncontrolled resource consumption in HackerOne uri-js node module

LOW 32

uri-js is a module that tries to fully implement RFC 3986.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.01321 Published 2018-06-04 Fixed in 3.0.0 CWE-400

Vulnerabilities

Filters

garycourt uri-js Mailto Header mailto.ts URI.parse uncaught exception

uri-js through 4.4.1 Improper UTF-8 Decoding via pctDecChars

uri-js through 4.4.1 Denial of Service via removeDotSegments

Uncontrolled resource consumption in HackerOne uri-js node module