Threats affecting pkg:npm/uri-js

CVE-2026-93690 is a denial of service vulnerability in the uri-js library (versions up to 4.4.1) caused by an infinite loop in the removeDotSegments function. This occurs when a path segment starts with Unicode line or paragraph separators, leading to indefinite blocking of the Node.js event loop and eventual heap exhaustion. The vulnerability can be triggered by calling removeDotSegments directly or indirectly via normalize or resolve functions with IRI handling enabled.