The uri-js library through version 4.4.1 contains an improper UTF-8 decoding vulnerability in the pctDecChars() function. This vulnerability arises because the function decodes invalid and overlong percent-encoded sequences into ASCII metacharacters. Attackers can exploit this by crafting percent-encoded payloads that bypass platform decoder validation mechanisms, enabling injection of path traversal or CRLF sequences. These injected sequences may be processed by downstream consumers without adequate filtering, potentially leading to security issues such as unauthorized file access or HTTP response splitting.

The vulnerability allows attackers to bypass platform decoder validation by using malformed percent-encoded sequences, which can lead to injection of path traversal or CRLF sequences. This may result in unauthorized access to files or manipulation of HTTP responses by downstream consumers that do not properly filter these inputs. The CVSS 4.0 score of 6.9 indicates a medium severity impact with network attack vector, low attack complexity, no privileges or user interaction required, and limited confidentiality and integrity impact.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should consider implementing input validation and filtering on percent-encoded sequences at application boundaries to mitigate potential injection of malicious sequences.