Executive brief
uri-js is a JavaScript library for parsing and validating URIs. A flaw in its UTF-8 decoding function allows attackers to craft specially encoded URIs that bypass validation and inject malicious path traversal or CRLF sequences. Applications using uri-js may process these injected sequences without proper filtering, potentially leading to unauthorized file access or response injection attacks.
Technical details
The pctDecChars() function improperly decodes overlong and invalid percent-encoded UTF-8 sequences, allowing bypass of platform decoder validation. An attacker can craft percent-encoded payloads that decode into ASCII metacharacters (e.g., path traversal "../" or CRLF "\r\n") that downstream URI consumers process without re-validation. This affects uri-js versions through 4.4.1; the vulnerability requires only network-level URI input and no authentication.
Affected products
- Gary Court uri-js through 4.4.1
Timeline
- 2026-09-18: disclosed