CVE-2026-93690: uri-js through 4.4.1 Denial of Service via removeDotSegments
uri-js through 4.4.1 contains a denial of service vulnerability in the removeDotSegments function that loops infinitely when a path segment begins with Unicode line or paragraph separators. Attackers can trigger this by calling removeDotSegments directly or through normalize/resolve functions with IRI handling enabled, causing the Node.js event loop to block indefinitely until heap exhaustion.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
uri-jsto a version that resolves this vulnerability.Fixed in 4.4.1 - Compensating control
Disable or mitigate IRI handling that enables the normalize/resolve code paths that invoke uri-js removeDotSegments (so attackers cannot trigger the infinite loop via IRI handling).
Event History
Frequently Asked Questions
Which applications are realistically exposed to this issue?
Applications using npm uri-js through 4.4.1 are exposed if they process attacker-controlled URI or IRI path data with removeDotSegments, or with normalize or resolve while IRI handling is enabled. The impact is denial of service in Node.js because the event loop can remain blocked until heap exhaustion.
What input is required to trigger the denial of service?
A path segment must begin with a Unicode line separator or paragraph separator. An attacker can supply this input to removeDotSegments directly, or reach it through normalize or resolve when IRI handling is enabled.
Does exploitation require authentication or user interaction?
No. The supplied vector indicates network attack, low complexity, no privileges required, and no user interaction.
What can be done if an update is not immediately available?
Avoid passing untrusted URI or IRI paths to the affected functions, especially when IRI handling is enabled. Reject or sanitize path segments that begin with Unicode line or paragraph separators before calling removeDotSegments, normalize, or resolve.