uri-js EUVD-2026-83256

Exploitation requires (1) a target application that uses uri-js (≤4.4.1) to parse, normalize, or percent-decode attacker-controlled URI input via the vulnerable pctDecChars() path, and (2) a downstream consumer that trusts uri-js's decoded output as already-validated and uses it to build a filesystem path or HTTP header/log line WITHOUT its own filtering. The flaw is remotely and unauthenticatedly triggerable (PR:N, UI:N) with a crafted percent-encoded payload, but the actual security impact is LIMITED by the consuming application's handling - if the downstream code re-validates the decoded string, or does not use it for path/header construction, no traversal or CRLF injection results. There is no availability impact and no direct code execution; harm is confined to path-traversal file access or CRLF/response-splitting in the specific downstream context.

This is a moderate-severity input-neutralization weakness (CWE-176, improper Unicode/UTF-8 handling) in the uri-js library, not a directly exploitable RCE or auth bypass. The vendor CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N, score 6.9) correctly reflects remote, unauthenticated, low-complexity triggering with only LOW integrity/confidentiality impact and NO availability impact - the flaw itself does not compromise a system, it undermines a downstream validator's assumptions. Real-world risk is entirely contingent on how consumers use uri-js output: pctDecChars() decodes invalid/overlong percent-encoded sequences into ASCII metacharacters, so the danger materializes only when a downstream consumer treats the decoded string as a trusted, already-validated path or header value and performs path traversal or CRLF injection with it. No EPSS score, no CISA KEV listing, and no public proof-of-concept were provided in the input, so there is no signal of active or automated exploitation; this is a supply-chain/library hygiene issue disclosed by VulnCheck rather than a confirmed in-the-wild threat. The main aggravating factor is breadth of deployment (uri-js is an extremely common transitive npm dependency), which raises aggregate exposure even though per-instance exploitability depends on the consuming application. Treat this as a patch-in-normal-cycle dependency update, elevated only where uri-js output feeds filesystem paths or HTTP headers without secondary validation.

An attacker submits a URI or URI component containing overlong/invalid percent-encoded bytes (e.g. an overlong encoding of '/' or CR/LF) to an application that normalizes or parses it with uri-js. Because pctDecChars() decodes these into raw ASCII metacharacters, the payload slips past platform decoder validation and reaches a downstream consumer, which then interprets the decoded '../' as path traversal or the injected CRLF as an HTTP header/log split. No public exploit code was identified at time of analysis; exploitation is remote and unauthenticated but depends on the downstream consumer processing the decoded output unsafely.