Skip to main content

uri-js CVE-2026-93690

| EUVDEUVD-2026-82986 HIGH
Loop with Unreachable Exit Condition (Infinite Loop) (CWE-835)
2026-09-18 VulnCheck GHSA-ffpj-9hx9-929p
Denial Of Service Node.js Red Hat Suse Uri Js
8.7
CVSS 4.0 · Vendor: VulnCheck
View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

  1. Access
    Identify Node service using uri-js URI parsing
  2. Delivery
    Submit URI with Unicode separator path segment
  3. Exploit
    removeDotSegments enters infinite loop
  4. Execution
    Event loop blocks, heap exhausts
  5. Impact
    Service denial of service

Vulnerability Assessment

Weakness
CWE
CWE-835
ASVS 5.0
V15 - Secure Coding and Architecture Loop termination conditions
MITRE ATT&CK

1 technique across 1 tactic: Impact

The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up.

Sign in to read
Exploitation Conditions

Exploitation requires the application to pass attacker-controlled input either directly into uri-js's removeDotSegments, or into normalize()/resolve() with IRI handling enabled - a crafted path segment beginning with a Unicode line separator (U+2028) or paragraph separator (U+2029) then triggers the infinite loop. It is remote and unauthenticated (PR:N/UI:N) at the network layer, but the practical limiting factor is that the vulnerable code path must actually be reachable with untrusted input; applications that only parse trusted/internal URIs or do not enable IRI handling for normalize/resolve are not exposed. There is no fixed version to upgrade to (4.4.1 is the latest release of an unmaintained package), so mitigation means input validation upstream or migrating off uri-js.
Impact

This is a genuine availability risk driven primarily by product prevalence rather than exploitation intelligence. The vendor CVSS 4.0 vector (AV:N/AC:L/PR:N/UI:N, VA:H, VC:N/VI:N) correctly characterizes a pure denial-of-service: no confidentiality or integrity impact, unauthenticated and network-reachable, mapping to a CVSS 3.1 equivalent of ~7.5 (A:H only). The 8.7 4.0 score is defensible. However, the raw vector overstates ease of reach: exploitation is only possible if the consuming application actually passes attacker-controlled input into removeDotSegments, or into normalize/resolve WITH IRI handling enabled - this application-layer precondition is not reflected in the AC:L/PR:N metrics and materially limits real-world exposure. No EPSS score, no CISA KEV listing, and no explicit weaponized POC are provided (the referenced GitHub issue #105 likely contains a reproduction trigger, but that is not confirmed exploit code). No SSVC decision data is provided. Net: no public exploit identified at time of analysis; treat as a supply-chain hygiene priority (because uri-js is a near-ubiquitous transitive dependency) rather than an actively-exploited emergency. A key remediation complication is that uri-js is effectively unmaintained and 4.4.1 is the latest release, so no fixed version exists - verify with the vendor/npm before assuming a patch.
Exploit ScenarioDerived

An attacker submits a crafted URI string whose path segment begins with a Unicode line or paragraph separator to an endpoint that internally normalizes or resolves URIs (or validates URI-format fields) using uri-js with IRI handling. The single request causes removeDotSegments to loop forever, blocking the Node.js event loop and driving the process toward heap exhaustion, taking the service offline. No public exploit code is confirmed, though the referenced GitHub issue likely documents the triggering input.
This Week Schedule remediation this week. Why: HIGH severity (CVSS 7.0-8.9).
No patch listed yet 0.5% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Sep 18, 2026

Denial of service in uri-js through 4.4.1 lets remote, unauthenticated attackers stall a Node.js process indefinitely: the removeDotSegments routine enters an infinite loop when a path segment begins with a Unicode line separator (U+2028) or paragraph separator (U+2029), blocking the event loop until heap exhaustion. The package is an unmaintained, widely pulled-in dependency (commonly transitively, e.g. via ajv), so the risk is driven by prevalence: no public exploit identified at time of analysis and no confirmed actively exploited (CISA KEV) status. Exposure is limited to applications that actually route untrusted input into removeDotSegments directly, or into normalize()/resolve() with IRI handling enabled; code paths handling only trusted or internal URIs are not reachable by this bug.

RemediationAI

No vendor-released patch identified at time of analysis: 4.4.1 is the newest release of the unmaintained uri-js package, so upgrading within the project is not a fix and remediation must be compensating controls or dependency replacement. The most direct mitigation is upstream input validation - reject or strip U+2028 (line separator) and U+2029 (paragraph separator) from any URI/IRI string before it reaches uri-js, and reject path segments that begin with those characters; this is low-cost but its trade-off is that legitimate IRI input containing those separators (rare in practice) is refused. If IRI support is not required, disable IRI handling for normalize()/resolve() calls or avoid passing untrusted data to removeDotSegments entirely, at the cost of losing non-ASCII IRI parsing. Longer term, migrate off uri-js to a maintained parser such as the WHATWG URL API built into Node.js (behavioral differences in edge-case parsing must be regression-tested). As a containment measure, run URI parsing in a worker thread or child process with a hard execution timeout so a stuck loop is killed rather than hanging the main event loop - this bounds availability impact but adds architectural complexity and per-request overhead. Verify the resolved dependency graph (for example with npm ls uri-js) to find transitive consumers. Advisory references for tracking: https://github.com/garycourt/uri-js/issues/105 and https://www.vulncheck.com/advisories/uri-js-through-4.4.1-denial-of-service-via-removedotsegments.

Affected VersionsENISA

uri-js 0 ≤4.4.1

Affected Packages

euvd uri_js no fix

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Sign in to check
Technical ContextAI · show details

uri-js is a JavaScript implementation of RFC 3986 URI parsing/resolution, distributed on npm and frequently consumed indirectly as a transitive dependency of JSON-schema and HTTP tooling. The vulnerable logic is the RFC 3986 removeDotSegments path-normalisation algorithm, implemented in src/uri.ts (see the upstream source pointers at lines 349 and 352-376); the root-cause class is CWE-835, Loop with Unreachable Exit Condition ('Infinite Loop'). The flaw is a tokenization/advance failure: when a path segment begins with the Unicode line separator U+2028 or paragraph separator U+2029, the segment-consuming step does not advance the input pointer, so the loop condition is never satisfied and the routine spins forever. Because removeDotSegments is invoked by normalize() and resolve() when IRI handling is enabled, any application that normalises or resolves attacker-supplied URI/IRI strings can be driven into the loop; the consequence is a single-threaded event loop hang followed by unbounded memory growth and eventual heap exhaustion, per the assigned CWE-835 and the availability-only (VC:N/VI:N/VA:H) impact in both the CVSS 4.0 score of 8.7 and the assessed CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H.

Know when Node.js gets its next vulnerability

  • Watch products and get an email when something new is published
  • Check this CVE against your own stack and servers
  • Exploit and PoC references, threat intelligence from 22 sources
Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (VulnCheck) PRIMARY 8.7 HIGH
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
vuln.today AI 7.5 HIGH

Network-reachable single crafted string with no auth or interaction blocks the event loop for a pure availability impact; no confidentiality/integrity effect.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
SUSE 7.5 HIGH
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Red Hat 7.5 HIGH

Primary rating from Vendor (VulnCheck).

CVSS VectorVendor: VulnCheck

Attack Vector
Network
Attack Complexity
Low
Attack Requirements
None
Privileges Required
None
User Interaction
None
Vulnerable system: Confidentiality
None
Vulnerable system: Integrity
None
Vulnerable system: Availability
High
Subsequent system: Confidentiality
None
Subsequent system: Integrity
None
Subsequent system: Availability
None

DescriptionCVE.org

uri-js through 4.4.1 contains a denial of service vulnerability in the removeDotSegments function that loops infinitely when a path segment begins with Unicode line or paragraph separators. Attackers can trigger this by calling removeDotSegments directly or through normalize/resolve functions with IRI handling enabled, causing the Node.js event loop to block indefinitely until heap exhaustion.

Executive ViewAI

Why It Matters

A high-severity availability flaw in uri-js, an unmaintained URI parsing library that most teams consume indirectly through packages such as ajv, allows a single crafted request to hang a Node.js process indefinitely until memory is exhausted. Because the library is pulled in transitively across many build and validation pipelines, the realistic exposure is broad even though only services that pass untrusted URL or IRI input into the affected parsing routines can actually be triggered. Leadership should treat this primarily as a service-availability and dependency-governance issue rather than a data-breach risk, and should prioritize identifying where the library is actually reachable before committing scarce engineering time to a large-scale migration.

Business Impact: High
Compensating Controls

No vendor-released patch identified at time of analysis. Interim mitigations: reject or strip Unicode line separator (U+2028) and paragraph separator (U+2029) characters from all externally supplied URI, path, and IRI input before parsing; avoid calling removeDotSegments, normalize(), or resolve() with IRI handling on untrusted input; run affected services under a process supervisor with memory limits and automatic restart to contain event-loop hangs; replace uri-js with a maintained URI parsing library or an internally patched fork with a bounded loop; and inventory transitive consumers (e.g. via ajv) to scope exposure.

Threat Intelligence Overview

EPSS Score
0.5%
Top 61% exploitable
Prevalence
Ubiquitous
uri-js is a transitive dependency of ajv, pulled into a huge fraction of npm projects
Data Quality
6 sources
Confidence: High
EUVD NVD CVE.org EPSS Vulnrichment Vendor GitHub

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue
Severity HIGH
CISA KEV No
Public POC No
EPSS 0.5%
Patch available No
Active threat No
Deciding rule
HIGH severity (CVSS 7.0-8.9)
What every action level means
Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.
Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.
This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.
This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.
Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision
Scheduled
Exploitation
Poc
System Exposure· derived
Open
Automatable
Yes
Human Impact
High
Technical Impact
Partial

Priority Score

44
Low Medium High Critical
KEV: 0
EPSS: 0
CVSS: +44
PoC: 0
Weaponized: 0
Threat intel: 0
Gov advisory: 0

Attack Technique

Denial of Service MEDIUM

Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.

More in Node.js

View all
CVE-2025-68613 HIGH POC
8.8 Dec 19

Remote code execution in n8n's workflow expression evaluation system allows an authenticated user with workflow creation
CVE-2024-41713 CRITICAL POC
9.1 Oct 21

A vulnerability in the NuPoint Unified Messaging (NPM) component of Mitel MiCollab through 9.8 SP1 FP2 (9.8.1.201) could
CVE-2024-55591 CRITICAL POC
9.8 Jan 14

FortiOS and FortiProxy contain an authentication bypass via the Node.js websocket module allowing unauthenticated remote
CVE-2023-44487 HIGH POC
7.5 Oct 10

Denial of service against HTTP/2 server implementations allows remote unauthenticated attackers to exhaust server resour
CVE-2014-7205 CRITICAL POC
10.0 Oct 08

Eval injection vulnerability in the internals.batch function in lib/batch.js in the bassmaster plugin before 1.5.2 for t
CVE-2025-59528 CRITICAL POC
10.0 Sep 22

Flowise version 3.0.5 contains a remote code execution vulnerability in the CustomMCP node. The mcpServerConfig paramete
CVE-2017-14849 HIGH POC
7.5 Sep 28

Node.js 8.5.0 before 8.6.0 allows remote attackers to access unintended files, because a change to ".." handling was inc
CVE-2017-5941 CRITICAL POC
9.8 Feb 09

An issue was discovered in the node-serialize package 0.0.4 for Node.js. Rated critical severity (CVSS 9.8), this vulner
CVE-2014-0224 HIGH POC
7.4 Jun 05

OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0.1h does not properly restrict processing of ChangeCiph
CVE-2014-3744 HIGH POC
7.5 Oct 23

Directory traversal vulnerability in the st module before 0.2.5 for Node.js allows remote attackers to read arbitrary fi
CVE-2014-9566 HIGH POC
7.5 Mar 10

Multiple SQL injection vulnerabilities in the Manage Accounts page in the AccountManagement.asmx service in the Solarwin
CVE-2013-4660 MEDIUM POC
6.8 Jun 28

The JS-YAML module before 2.0.5 for Node.js parses input without properly considering the unsafe !!js/function tag, whic

Same weakness CWE-835 – Loop with Unreachable Exit Condition (Infinite Loop)

View all
CVE-2024-20353 HIGH POC
8.6
CVE-2020-13935 HIGH POC
7.5
CVE-2017-16944 HIGH POC
7.5
CVE-2022-0778 HIGH POC
7.5
CVE-2024-43366 CRITICAL POC
9.1
CVE-2026-25533 HIGH POC
8.8
CVE-2018-8002 HIGH POC
8.8
CVE-2026-66730 HIGH POC
8.7

Same technique Denial Of Service

View all
CVE-2015-5119 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2011-0611 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8
CVE-2012-0507 CRITICAL POC
9.8
CVE-2014-1761 HIGH POC
7.8
CVE-2015-5122 CRITICAL POC
9.8
CVE-2011-0609 HIGH POC
7.8

Vendor StatusVendor

SUSE

Severity: Important
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise High Performance Computing 12 Not-Affected
SUSE Linux Enterprise Micro 5.3 Affected
SUSE Linux Enterprise Micro 5.3 Affected
SUSE Linux Enterprise Micro 5.3 Affected

References

Advisories & patches
ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2026-93690 REF https://github.com/garycourt/uri-js REF https://github.com/garycourt/uri-js/blob/4.4.0/src/uri.ts#L349 REF https://github.com/garycourt/uri-js/blob/4.4.0/src/uri.ts#L352-L376 REF https://github.com/garycourt/uri-js/issues/105 REF https://www.npmjs.com/package/uri-js/v/4.4.1 REF https://www.vulncheck.com/advisories/uri-js-through-4.4.1-denial-of-service-via-removedotsegments

Search Externally

GitHub PoC Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy