# CVE-2022-1233: medialize uri.js URL confusion with missing scheme

Source: https://junglewise.ai/threats/cve-2022-1233-medialize-uri-js-url-confusion-with-missing-scheme  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2022-04-05. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2022-1233 · Severity: low · CVSS 3 · Published 2022-04-05

URI.js is a JavaScript library used to parse and manipulate URLs in web applications. When parsing URLs without a scheme (protocol) and with excessive slashes like "///www.example.com", the library incorrectly parses the hostname as null instead of recognizing it as a domain, causing the URL to be treated differently than web browsers would. This can lead to unintended redirects or cross-site request forgery (CSRF) attacks if user input is parsed without proper validation.

Technologies: [urijs (npm)](https://junglewise.ai/threats/technologies/urijs). Vendors: [npm](https://junglewise.ai/threats/vendors/npm).

## Quick answers

**Is CVE-2022-1233 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2022-1233 being exploited in the wild.

**How severe is CVE-2022-1233?** Low severity, with a CVSS score of 3, published 5 April 2022.

**Which products and versions are affected?** urijs (npm) SEMVER:introduced=0,fixed=1.19.11.

**Is there a fix for CVE-2022-1233?** Yes. urijs (npm): upgrade to 1.19.11 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2022-1233 attacked?** It is attacked over the network.

**Am I affected by CVE-2022-1233?** Check whether you run urijs (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- urijs (npm): upgrade to 1.19.11 or later

  ```sh
  npm install urijs@1.19.11
  ```


## Technical details

The vulnerability is a URL parsing inconsistency in URI.js versions prior to 1.19.11. When a URL lacks a scheme and contains excessive leading slashes (e.g., "///www.example.com"), the parser incorrectly sets hostname to null and stores the entire path as "/www.example.com", diverging from browser behavior which treats this as an absolute URL to www.example.com. This discrepancy (CWE-115: Misinterpretation of Input, CWE-601: URL Redirection to Untrusted Site) can be exploited by attackers to craft URLs that bypass validation logic or trigger unintended redirects. The vulnerability requires network-accessible application parsing untrusted URLs and is remotely exploitable without authentication. A patch was released in version 1.19.11 addressing the parsing logic for scheme-relative URLs with excessive slashes.

## Affected products

- medialize uri.js < 1.19.11

## Identifiers

- CVE-2022-1233
- GHSA-g694-m8vq-gv9h

## Timeline

- 2022-04-05: disclosed
- 2022-04-05: patched: Fixed in version 1.19.11

## References

- [https://github.com/medialize/uri.js/commit/88805fd3da03bd7a5e60947adb49d182011f1277](https://github.com/medialize/uri.js/commit/88805fd3da03bd7a5e60947adb49d182011f1277)

## Related threats

- [medialize urijs incorrect protocol extraction via whitespace characters](https://junglewise.ai/threats/cve-2022-1243-medialize-urijs-incorrect-protocol-extraction-via-whitespace)
- [urijs open redirect in URL parsing](https://junglewise.ai/threats/cve-2022-0868-urijs-open-redirect-in-url-parsing)
- [URI.js leading whitespace bypasses protocol validation](https://junglewise.ai/threats/cve-2022-24723-uri-js-leading-whitespace-bypasses-protocol-validation)
- [urijs authorization bypass via case-insensitive scheme](https://junglewise.ai/threats/cve-2022-0613-urijs-authorization-bypass-via-case-insensitive-scheme)
- [URIjs hostname spoofing via backslashes in URL](https://junglewise.ai/threats/cve-2021-3647-urijs-hostname-spoofing-via-backslashes-in-url)