Threats affecting pkg:npm/garycourt/uri-js

CVE-2026-103387 is a medium severity vulnerability in the garycourt uri-js library versions 4.4.0 and 4.4.1. It involves an uncaught exception in the URI.parse function's Mailto Header Handler component, which can be triggered remotely by manipulating the function's argument, potentially causing application errors. No official fix or patch has been announced, and the project has not responded to the issue report. Exploit code is publicly available, but no active exploitation in the wild has been reported.

CVE-2026-93751 is a medium severity vulnerability in the uri-js library (up to version 4.4.1) caused by improper UTF-8 decoding in the pctDecChars() function. This flaw allows decoding of invalid and overlong percent-encoded sequences into ASCII metacharacters, enabling attackers to craft payloads that bypass platform decoder validation. Such payloads can inject path traversal or CRLF sequences that downstream consumers may process without proper filtering.