# CVE-2020-26291: Medialize URI.js hostname spoofing via backslashes in URL

Source: https://junglewise.ai/threats/cve-2020-26291-medialize-uri-js-hostname-spoofing-via-backslashes-in-url  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2020-12-30. Updated: 2026-05-14  
License: CC BY 4.0 with a link back

CVE-2020-26291 · Severity: low · CVSS 3.1 · Published 2020-12-30

URI.js is a popular JavaScript library used by developers to handle and modify web addresses (URLs). A flaw in how it reads certain characters allows an attacker to trick the library into identifying the wrong website as the 'host.' This can lead to security failures where the software incorrectly allows access to restricted data, redirects users to malicious sites, or bypasses safety filters.

Technologies: [urijs (npm)](https://junglewise.ai/threats/technologies/urijs). Vendors: [npm](https://junglewise.ai/threats/vendors/npm).

## Quick answers

**Is CVE-2020-26291 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2020-26291 being exploited in the wild.

**How severe is CVE-2020-26291?** Low severity, with a CVSS score of 3.1, published 30 December 2020.

**Which products and versions are affected?** urijs (npm) SEMVER:introduced=0,fixed=1.19.4.

**Is there a fix for CVE-2020-26291?** Yes. urijs (npm): upgrade to 1.19.4 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2020-26291 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2020-26291?** Check whether you run urijs (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- urijs (npm): upgrade to 1.19.4 or later

  ```sh
  npm install urijs@1.19.4
  ```


## Technical details

A vulnerability exists in URI.js (npm package urijs) prior to version 1.19.4 due to improper input validation in the URL parsing logic. Specifically, the parser fails to correctly handle backslash (\) characters when they precede an '@' symbol in the authority component of a URL. An attacker can craft a URL like 'https://expected.com\@attacker.com' which the library incorrectly parses as having 'attacker.com' as the hostname. This discrepancy from the WHATWG URL specification can be exploited to bypass security checks that rely on hostname validation, potentially leading to SSRF, open redirects, or authorization bypasses. The issue is fully resolved in version 1.19.4.

## Affected products

- medialize urijs < 1.19.4

## Identifiers

- CVE-2020-26291
- GHSA-3329-pjwv-fjpg

## Timeline

- 2020-12-23: patched: Version 1.19.4 released with a complete fix.
- 2020-12-30: disclosed: Public advisory published.

## References

- [https://github.com/medialize/URI.js/security/advisories/GHSA-3329-pjwv-fjpg](https://github.com/medialize/URI.js/security/advisories/GHSA-3329-pjwv-fjpg)
- [https://github.com/medialize/URI.js/commit/b02bf037c99ac9316b77ff8bfd840e90becf1155](https://github.com/medialize/URI.js/commit/b02bf037c99ac9316b77ff8bfd840e90becf1155)
- [https://github.com/medialize/URI.js](https://github.com/medialize/URI.js)
- [https://github.com/medialize/URI.js/releases/tag/v1.19.4](https://github.com/medialize/URI.js/releases/tag/v1.19.4)
- [https://www.npmjs.com/advisories/1595](https://www.npmjs.com/advisories/1595)
- [https://www.npmjs.com/package/urijs](https://www.npmjs.com/package/urijs)

## Related threats

- [medialize urijs incorrect protocol extraction via whitespace characters](https://junglewise.ai/threats/cve-2022-1243-medialize-urijs-incorrect-protocol-extraction-via-whitespace)
- [medialize uri.js URL confusion with missing scheme](https://junglewise.ai/threats/cve-2022-1233-medialize-uri-js-url-confusion-with-missing-scheme)
- [urijs open redirect in URL parsing](https://junglewise.ai/threats/cve-2022-0868-urijs-open-redirect-in-url-parsing)
- [URI.js leading whitespace bypasses protocol validation](https://junglewise.ai/threats/cve-2022-24723-uri-js-leading-whitespace-bypasses-protocol-validation)
- [urijs authorization bypass via case-insensitive scheme](https://junglewise.ai/threats/cve-2022-0613-urijs-authorization-bypass-via-case-insensitive-scheme)