# CVE-2021-27516: URIjs hostname spoofing via backslashes

Source: https://junglewise.ai/threats/cve-2021-27516-urijs-hostname-spoofing-via-backslashes  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2021-03-01. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2021-27516 · Severity: low · CVSS 3.1 · Published 2021-03-01

URIjs is a JavaScript library used to parse and manipulate URLs in web applications. The library incorrectly handles backslash characters in URLs, allowing attackers to spoof the hostname component. If an application relies on URIjs to validate or enforce security policies based on hostname (such as allow/block lists or access controls), an attacker could bypass these protections, potentially leading to unauthorized access or redirects to malicious sites.

Technologies: [urijs (npm)](https://junglewise.ai/threats/technologies/urijs). Vendors: [npm](https://junglewise.ai/threats/vendors/npm).

## Quick answers

**Is CVE-2021-27516 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2021-27516 being exploited in the wild.

**How severe is CVE-2021-27516?** Low severity, with a CVSS score of 3.1, published 1 March 2021.

**Which products and versions are affected?** urijs (npm) SEMVER:introduced=0,fixed=1.19.6.

**Is there a fix for CVE-2021-27516?** Yes. urijs (npm): upgrade to 1.19.6 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2021-27516 attacked?** It is attacked over the network.

**Am I affected by CVE-2021-27516?** Check whether you run urijs (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- urijs (npm): upgrade to 1.19.6 or later

  ```sh
  npm install urijs@1.19.6
  ```


## Technical details

The vulnerability is an improper input validation issue (CWE-20) in URL parsing where backslashes in the scheme delimiter are not properly handled. Affected versions of URIjs parse URLs like "https:/\expected-example.com" as having no hostname, whereas the correct behavior (per WHATWG URL specification) is to extract "expected-example.com". The attack vector is network-based with no authentication or user interaction required—an attacker simply crafts a malicious URL and causes an application using URIjs to parse it. Depending on how the application uses the parsed hostname, impacts include bypass of security allow/block lists, Server-Side Request Forgery (SSRF) attacks, and open redirects. Version 1.19.6 and later patch this issue to align with WHATWG URL specification compliance and browser behavior.

## Affected products

- medialize URIjs before 1.19.6

## Identifiers

- CVE-2021-27516
- GHSA-p6j9-7xhc-rhwp

## Timeline

- 2021-02-22: disclosed
- 2021-03-01: advisory
- 2021: patched: Version 1.19.6 released with fix

## References

- [https://github.com/medialize/URI.js/security/advisories/GHSA-p6j9-7xhc-rhwp](https://github.com/medialize/URI.js/security/advisories/GHSA-p6j9-7xhc-rhwp)

## Related threats

- [medialize urijs incorrect protocol extraction via whitespace characters](https://junglewise.ai/threats/cve-2022-1243-medialize-urijs-incorrect-protocol-extraction-via-whitespace)
- [medialize uri.js URL confusion with missing scheme](https://junglewise.ai/threats/cve-2022-1233-medialize-uri-js-url-confusion-with-missing-scheme)
- [urijs open redirect in URL parsing](https://junglewise.ai/threats/cve-2022-0868-urijs-open-redirect-in-url-parsing)
- [URI.js leading whitespace bypasses protocol validation](https://junglewise.ai/threats/cve-2022-24723-uri-js-leading-whitespace-bypasses-protocol-validation)
- [urijs authorization bypass via case-insensitive scheme](https://junglewise.ai/threats/cve-2022-0613-urijs-authorization-bypass-via-case-insensitive-scheme)