CVE-2026-93690 (High) detected in uri-js-4.4.1.tgz

[mend-bolt-for-github]

CVE-2026-93690 - High Severity Vulnerability

Vulnerable Library - uri-js-4.4.1.tgz

An RFC 3986/3987 compliant, scheme extendable URI/IRI parsing/validating/resolving library for JavaScript.

Library home page: https://registry.npmjs.org/uri-js/-/uri-js-4.4.1.tgz

Sample Path to Dependency File: /package.json

Path to vulnerable library: /node_modules/uri-js/package.json

Dependency Hierarchy:

• eslint-8.3.0.tgz (Root Library)
  • ajv-6.12.6.tgz
    • ❌ uri-js-4.4.1.tgz (Vulnerable Library)

Found in base branch: master

Vulnerability Details

uri-js through 4.4.1 contains a denial of service vulnerability in the removeDotSegments function that loops infinitely when a path segment begins with Unicode line or paragraph separators. Attackers can trigger this by calling removeDotSegments directly or through normalize/resolve functions with IRI handling enabled, causing the Node.js event loop to block indefinitely until heap exhaustion.

Publish Date: 2026-09-18

URL: CVE-2026-93690

CVSS 3 Score Details (7.5)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: None
  • Availability Impact: High

For more information on CVSS3 Scores, click here.

---

Step up your Open Source Security Game with Mend here