Executive brief
uri-js is a JavaScript library for parsing and normalizing URIs and IRIs. A flaw in the removeDotSegments function causes it to loop infinitely when processing certain Unicode characters, allowing an attacker to block the application's event loop and exhaust memory, resulting in a denial of service.
Technical details
The removeDotSegments function contains an infinite loop vulnerability triggered when a path segment begins with Unicode line or paragraph separators. The vulnerability can be exploited directly via the removeDotSegments function or indirectly through normalize and resolve functions when IRI handling is enabled. An attacker can cause the Node.js process to hang until heap exhaustion, blocking all other work.
Affected products
- Gary Court uri-js through 4.4.1
Timeline
- 2026-09-18: disclosed