Garycourt Uri Js
Don't miss out!
Thousands of developers use stack.watch to stay informed.Get an email whenever new security vulnerabilities are reported in Garycourt Uri Js.
By the Year
In 2026 there have been 2 vulnerabilities in Garycourt Uri Js with an average score of 7.8 out of ten. Uri Js did not have any published security vulnerabilities last year. That is, 2 more vulnerabilities have already been reported in 2026 as compared to last year.
| Year | Vulnerabilities | Average Score |
|---|---|---|
| 2026 | 2 | 7.80 |
| 2025 | 0 | 0.00 |
| 2024 | 0 | 0.00 |
| 2023 | 0 | 0.00 |
| 2022 | 0 | 0.00 |
| 2021 | 0 | 0.00 |
| 2020 | 0 | 0.00 |
| 2019 | 0 | 0.00 |
| 2018 | 1 | 6.50 |
It may take a day or so for new Uri Js vulnerabilities to show up in the stats or in the list of recent security vulnerabilities. Additionally vulnerabilities may be tagged under a different product or component name.
Recent Garycourt Uri Js Security Vulnerabilities
uri-js <=4.4.1 Improper UTF-8 decoding in pctDecChars() allows path traversal
CVE-2026-93751
6.9 - Medium
- September 18, 2026
uri-js through 4.4.1 contains an improper UTF-8 decoding vulnerability in pctDecChars() that decodes invalid and overlong percent-encoded sequences into ASCII metacharacters. Attackers can craft percent-encoded payloads to bypass platform decoder validation and inject path traversal or CRLF sequences that downstream consumers process without filtering.
Improper Handling of Unicode Encoding
Denial of Service in uri-js <=4.4.1 removeDotSegments Unicode separator loop
CVE-2026-93690
8.7 - High
- September 18, 2026
uri-js through 4.4.1 contains a denial of service vulnerability in the removeDotSegments function that loops infinitely when a path segment begins with Unicode line or paragraph separators. Attackers can trigger this by calling removeDotSegments directly or through normalize/resolve functions with IRI handling enabled, causing the Node.js event loop to block indefinitely until heap exhaustion.
Infinite Loop
uri-js is a module that tries to fully implement RFC 3986
CVE-2017-16021
6.5 - Medium
- June 04, 2018
uri-js is a module that tries to fully implement RFC 3986. One of these features is validating whether or not a supplied URL is valid or not. To do this, uri-js uses a regular expression, This regular expression is vulnerable to redos. This causes the program to hang and the CPU to idle at 100% usage while uri-js is trying to validate if the supplied URL is valid or not. To check if you're vulnerable, look for a call to `require("uri-js").parse()` where a user is able to send their own input. This affects uri-js 2.1.1 and earlier.
ReDoS
Stay on top of Security Vulnerabilities
Want an email whenever new vulnerabilities are published for Garycourt Uri Js or by Garycourt? Click the Watch button to subscribe.
