Threat database

CVE-2026-103387 is a medium severity vulnerability in the garycourt uri-js library versions 4.4.0 and 4.4.1. It involves an uncaught exception in the URI.parse function's Mailto Header Handler component, which can be triggered remotely by manipulating the function's argument, potentially causing application errors. No official fix or patch has been announced, and the project has not responded to the issue report. Exploit code is publicly available, but no active exploitation in the wild has been reported.

CVE-2026-93751 is a medium severity vulnerability in the uri-js library (up to version 4.4.1) caused by improper UTF-8 decoding in the pctDecChars() function. This flaw allows decoding of invalid and overlong percent-encoded sequences into ASCII metacharacters, enabling attackers to craft payloads that bypass platform decoder validation. Such payloads can inject path traversal or CRLF sequences that downstream consumers may process without proper filtering.

CVE-2026-93690 is a denial of service vulnerability in the uri-js library (versions up to 4.4.1) caused by an infinite loop in the removeDotSegments function. This occurs when a path segment starts with Unicode line or paragraph separators, leading to indefinite blocking of the Node.js event loop and eventual heap exhaustion. The vulnerability can be triggered by calling removeDotSegments directly or indirectly via normalize or resolve functions with IRI handling enabled.