# CVE-2022-0613: urijs authorization bypass via case-insensitive scheme

Source: https://junglewise.ai/threats/cve-2022-0613-urijs-authorization-bypass-via-case-insensitive-scheme  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2022-02-17. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2022-0613 · Severity: low · CVSS 3.1 · Published 2022-02-17

urijs is a JavaScript library for parsing and manipulating URIs. The library failed to handle case-insensitive protocol schemes (HTTP, htTP, HTtp, etc.) when validating URIs, allowing attackers to bypass authorization checks that were previously patched. An attacker could craft URLs with mixed-case schemes to circumvent security controls that depend on protocol validation.

Technologies: [urijs (npm)](https://junglewise.ai/threats/technologies/urijs). Vendors: [npm](https://junglewise.ai/threats/vendors/npm).

## Quick answers

**Is CVE-2022-0613 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2022-0613 being exploited in the wild.

**How severe is CVE-2022-0613?** Low severity, with a CVSS score of 3.1, published 17 February 2022.

**Which products and versions are affected?** urijs (npm) SEMVER:introduced=0,fixed=1.19.8.

**Is there a fix for CVE-2022-0613?** Yes. urijs (npm): upgrade to 1.19.8 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2022-0613 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2022-0613?** Check whether you run urijs (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- urijs (npm): upgrade to 1.19.8 or later

  ```sh
  npm install urijs@1.19.8
  ```


## Technical details

The vulnerability is an authorization bypass in urijs due to case-insensitive scheme handling (CWE-639). The library's scheme validation logic was case-sensitive, allowing attackers to bypass security controls implemented in patch CVE-2021-3647 by using mixed-case protocol schemes (e.g., HTTP, htTP) in URIs. No authentication is required; this is a network-reachable vulnerability affecting any application that relies on urijs for URI validation and authorization decisions. An attacker can bypass URL-based access controls, potentially leading to unauthorized access to protected resources. The vulnerability was fixed in version 1.19.8 with a commit implementing case-insensitive scheme parsing.

## Affected products

- urijs before 1.19.8

## Identifiers

- CVE-2022-0613
- GHSA-gcv8-gh4r-25x6

## Timeline

- 2022-02-17: disclosed
- 2022-02-17: patched: Fixed in version 1.19.8

## References

- [https://github.com/medialize/uri.js/commit/6ea641cc8648b025ed5f30b090c2abd4d1a5249f](https://github.com/medialize/uri.js/commit/6ea641cc8648b025ed5f30b090c2abd4d1a5249f)

## Related threats

- [medialize urijs incorrect protocol extraction via whitespace characters](https://junglewise.ai/threats/cve-2022-1243-medialize-urijs-incorrect-protocol-extraction-via-whitespace)
- [medialize uri.js URL confusion with missing scheme](https://junglewise.ai/threats/cve-2022-1233-medialize-uri-js-url-confusion-with-missing-scheme)
- [urijs open redirect in URL parsing](https://junglewise.ai/threats/cve-2022-0868-urijs-open-redirect-in-url-parsing)
- [URI.js leading whitespace bypasses protocol validation](https://junglewise.ai/threats/cve-2022-24723-uri-js-leading-whitespace-bypasses-protocol-validation)
- [URIjs hostname spoofing via backslashes in URL](https://junglewise.ai/threats/cve-2021-3647-urijs-hostname-spoofing-via-backslashes-in-url)