uri-js CVE-2026-103387

Exploitation requires the target application to invoke uri-js's URI.parse() on attacker-controlled input containing a crafted mailto: scheme URI (the vulnerable Mailto Header Handler in src/schemes/mailto.ts). No authentication or special privileges are needed (PR:N), and the malicious URI can be delivered remotely through any input channel the app parses. Limiting factors: impact is confined to a low-severity availability hit (an uncaught exception) rather than code execution or data exposure; applications that wrap URI.parse in exception handling, or that never parse untrusted mailto URIs, are not affected; and there is no fixed version, so mitigation relies on caller-side try/catch or input validation. Affects uri-js versions up to and including 4.4.1.

This is a low-to-moderate real-world risk that maps well to its 5.3 (CVSS 4.0) score. The vendor vector CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:L describes a remotely reachable, unauthenticated, low-complexity flaw whose ONLY technical impact is a low-severity availability hit (VA:L) - confidentiality and integrity are explicitly N, so this is a denial-of-service/robustness bug (CWE-248 uncaught exception), not information disclosure. E:P in the vector plus the reference to garycourt/uri-js issue #103 confirms 'publicly available exploit code exists,' but there is no CISA KEV listing and no EPSS score in the input, so there is no evidence of active exploitation - treat POC availability and active exploitation as distinct signals. Note a data conflict: the Tags label this 'Information Disclosure,' which directly contradicts the CVSS impacts (VC:N, only VA:L) - the actual effect is an application-crashing exception, not data disclosure. Realistic impact is bounded because the crash only propagates if the consuming application calls URI.parse on attacker-controlled mailto: input without exception handling; many callers wrap parsing in try/catch, further limiting blast radius. This is a hygiene/patch-when-convenient issue rather than an emergency, tempered by the fact that the maintainer has not responded and the project is effectively unmaintained.

An attacker submits a malformed mailto: URI (e.g., via a form field, API parameter, message header, or webhook payload) to an application that calls uri-js URI.parse() on that input. The crafted argument to the mailto header handler triggers an uncaught exception in src/schemes/mailto.ts, crashing the request handler or, in a single-threaded Node.js process without proper error handling, the whole service. Public proof-of-concept exists in the project's GitHub issue #103.