CVE-2026-93690 in uri-js
Summary
by MITRE • 09/18/2026
uri-js through 4.4.1 contains a denial of service vulnerability in the removeDotSegments function that loops infinitely when a path segment begins with Unicode line or paragraph separators. Attackers can trigger this by calling removeDotSegments directly or through normalize/resolve functions with IRI handling enabled, causing the Node.js event loop to block indefinitely until heap exhaustion.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 09/18/2026
The vulnerability identified in uri-js versions up to 4.4.1 represents a critical denial of service flaw rooted in the logic governing path segment normalization. Specifically, the removeDotSegments function fails to properly handle certain Unicode characters that serve as line or paragraph separators. When an input string containing these specific separator characters is processed, the internal loop responsible for resolving relative references and normalizing paths enters an infinite iteration state. This behavior occurs because the algorithm does not correctly account for how these non-standard whitespace-like characters interact with the dot-segment removal logic, leading to a scenario where the termination condition of the loop is never met under specific input conditions involving IRI handling enabled scenarios.
From a technical perspective, this flaw allows an attacker to trigger a resource exhaustion attack by supplying maliciously crafted Uniform Resource Identifiers or IRIs that include these problematic Unicode separators. Since uri-js is frequently used in Node.js environments for parsing and manipulating URLs within web applications and API services, the impact of blocking the event loop is severe. The infinite loop consumes CPU cycles continuously without yielding control back to the event loop scheduler. This effectively freezes the application's ability to process other requests or events, leading to a complete service outage. If left unchecked over time, this can also lead to heap exhaustion as memory allocations associated with the processing continue indefinitely, further destabilizing the host system and potentially causing crashes in dependent services that rely on timely responses from the affected component.
This vulnerability aligns closely with CWE-835, which describes a loop involving an infinite wait condition, and is often categorized under denial of service attacks where availability is compromised through resource exhaustion. In terms of offensive security frameworks such as MITRE ATT&CK, this behavior can be associated with techniques that aim to disrupt services by consuming computational resources, potentially falling under categories related to impact or defense evasion depending on the context in which it is exploited. The lack of proper input validation and boundary checking for Unicode character handling highlights a common oversight in library development where edge cases involving internationalized resource identifiers are not sufficiently tested against all possible valid but pathological inputs defined by RFC standards.
To mitigate this risk, organizations utilizing uri-js must immediately upgrade to version 4.4.2 or later, where the removeDotSegments function has been patched to correctly handle these Unicode separators and prevent infinite looping. For environments that cannot be updated instantly due to dependency constraints, implementing input validation at the application layer is recommended as a temporary countermeasure. This involves sanitizing incoming URL strings to reject any characters outside of expected ASCII ranges or explicitly blocking known problematic Unicode line and paragraph separator codes before they are passed to uri-js functions. Additionally, deploying runtime protection mechanisms such as CPU usage monitoring and request timeout configurations can help detect and terminate processes that exhibit signs of hanging due to this vulnerability, thereby preserving the availability of critical services while a permanent fix is deployed.