CVE-2026-103387 in uri-js
Summary
by MITRE • 09/30/2026
A weakness has been identified in garycourt uri-js up to 4.4.1. This affects the function URI.parse of the file src/schemes/mailto.ts of the component Mailto Header Handler. This manipulation of the argument to causes uncaught exception. The attack may be initiated remotely. The exploit has been made available to the public and could be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 09/30/2026
The vulnerability identified in garycourt uri-js versions up to 4.4.1 represents a critical input validation failure within the URI parsing logic, specifically affecting the mailto scheme handler located in src/schemes/mailto.ts. This component is responsible for interpreting and validating Uniform Resource Identifiers that utilize the mailto protocol, which is commonly used in web applications to trigger email clients or process contact form submissions. The core technical flaw lies in how the library handles malformed or excessively complex arguments passed to the URI.parse function. When an attacker supplies a specifically crafted input string designed to exploit edge cases in the parsing algorithm, the internal state of the parser becomes corrupted or enters an invalid condition that triggers an uncaught exception within the Node.js runtime environment. This behavior indicates a lack of robust error handling and boundary checking for specific character sequences or structural anomalies in the URI syntax, allowing external inputs to disrupt normal program execution flow rather than being gracefully rejected as malformed data.
From a technical perspective, this vulnerability is classified under CWE-20 Improper Input Validation, as the application fails to adequately sanitize or validate user-supplied input before processing it through the parsing engine. The resulting uncaught exception leads directly to CWE-756 Missing Error Handling, where the system does not catch and manage runtime errors appropriately, causing the process to terminate abruptly. In the context of modern web architectures using Node.js, such an error typically results in a Denial of Service condition for the specific request or potentially the entire application instance if unhandled exceptions are not globally managed by the framework. The attack vector is remote, meaning that no authentication or local access is required to trigger this flaw. An attacker can simply send a malicious HTTP request containing the crafted URI payload to any endpoint that utilizes uri-js for parsing mailto links, thereby inducing a crash in the server-side processing logic.
The operational impact of this vulnerability extends beyond simple service disruption. Because an exploit has been made publicly available, automated scanning tools and opportunistic attackers can readily leverage this flaw against vulnerable systems. In environments where high availability is critical, such as e-commerce platforms or customer-facing web applications, a successful exploitation attempt could lead to significant downtime, loss of user trust, and potential data integrity issues if the crash occurs during sensitive transaction processing. Furthermore, in some Node.js configurations, unhandled exceptions can leak stack traces back to the client, providing attackers with valuable information about the underlying technology stack, version numbers, and file paths, which facilitates further reconnaissance and targeted attacks against other known vulnerabilities within that environment.
Mitigation strategies must focus on immediate remediation through dependency updates as well as defensive coding practices for applications unable to upgrade immediately. The primary recommendation is to update the garycourt uri-js package to a patched version where this input validation flaw has been resolved by the maintainers. If an immediate patch is unavailable, developers should implement strict input filtering at the application layer before passing URIs to the parsing function. This includes validating that inputs conform to expected RFC standards for mailto schemes and rejecting any strings containing unusual character sequences or excessive length. Additionally, implementing global uncaught exception handlers in Node.js applications can prevent crashes from taking down entire services, although this is a compensating control rather than a fix for the root cause. Organizations should also monitor security advisories closely as the project has been notified but has not yet responded, suggesting that patch availability may be delayed and alternative defensive measures are necessary to maintain operational resilience against active exploitation attempts.