# CVE-2021-3647: URIjs hostname spoofing via backslashes in URL

Source: https://junglewise.ai/threats/cve-2021-3647-urijs-hostname-spoofing-via-backslashes-in-url  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2021-07-19. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2021-3647 · Severity: low · CVSS 3 · Published 2021-07-19

URIjs is a popular JavaScript library for parsing and manipulating URLs. An attacker can craft malicious URLs using backslash characters to spoof the hostname, causing the library to incorrectly identify which site a URL points to. This could bypass security filters, enable phishing attacks, or allow attackers to circumvent access controls in applications that rely on hostname validation.

Technologies: [urijs (npm)](https://junglewise.ai/threats/technologies/urijs). Vendors: [npm](https://junglewise.ai/threats/vendors/npm).

## Quick answers

**Is CVE-2021-3647 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2021-3647 being exploited in the wild.

**How severe is CVE-2021-3647?** Low severity, with a CVSS score of 3, published 19 July 2021.

**Which products and versions are affected?** urijs (npm) SEMVER:introduced=0,fixed=1.19.7.

**Is there a fix for CVE-2021-3647?** Yes. urijs (npm): upgrade to 1.19.7 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2021-3647 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2021-3647?** Check whether you run urijs (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- urijs (npm): upgrade to 1.19.7 or later

  ```sh
  npm install urijs@1.19.7
  ```


## Technical details

The vulnerability is a hostname parsing bypass (CWE-601: URL Redirection to Untrusted Site) in URIjs versions prior to 1.19.7. The root cause is improper handling of backslash characters in the scheme delimiter portion of a URL; an attacker can use combinations like `scheme:/\/\/\hostname` to spoof the hostname. Affected versions incorrectly parse such URLs and return no hostname, while patched versions align with the WHATWG URL specification. The vulnerability requires no authentication or user interaction—an attacker simply needs to provide a malicious URL to an application using the vulnerable library. Exploitation can enable allow/block list bypasses, SSRF attacks, open redirects, and other security decision failures. Version 1.19.7 and later include the fix.

## Affected products

- medialize URIjs < 1.19.7

## Identifiers

- CVE-2021-3647
- GHSA-89gv-h8wf-cg8r

## Timeline

- 2021-07-19: disclosed
- 2021-07-19: patched: Version 1.19.7 released

## References

- [https://github.com/medialize/URI.js/security/advisories/GHSA-89gv-h8wf-cg8r](https://github.com/medialize/URI.js/security/advisories/GHSA-89gv-h8wf-cg8r)

## Related threats

- [medialize urijs incorrect protocol extraction via whitespace characters](https://junglewise.ai/threats/cve-2022-1243-medialize-urijs-incorrect-protocol-extraction-via-whitespace)
- [medialize uri.js URL confusion with missing scheme](https://junglewise.ai/threats/cve-2022-1233-medialize-uri-js-url-confusion-with-missing-scheme)
- [urijs open redirect in URL parsing](https://junglewise.ai/threats/cve-2022-0868-urijs-open-redirect-in-url-parsing)
- [URI.js leading whitespace bypasses protocol validation](https://junglewise.ai/threats/cve-2022-24723-uri-js-leading-whitespace-bypasses-protocol-validation)
- [urijs authorization bypass via case-insensitive scheme](https://junglewise.ai/threats/cve-2022-0613-urijs-authorization-bypass-via-case-insensitive-scheme)