CVE-2026-93751: uri-js through 4.4.1 Improper UTF-8 Decoding via pctDecChars
uri-js through 4.4.1 contains an improper UTF-8 decoding vulnerability in pctDecChars() that decodes invalid and overlong percent-encoded sequences into ASCII metacharacters. Attackers can craft percent-encoded payloads to bypass platform decoder validation and inject path traversal or CRLF sequences that downstream consumers process without filtering.
Affected Software
Event History
Frequently Asked Questions
Which deployments are exposed?
Deployments using npm/uri-js through version 4.4.1 are affected when they decode untrusted percent-encoded URI data and pass the result to downstream consumers that do not filter the resulting metacharacters.
What does an attacker need to exploit this issue?
An attacker needs to supply a crafted percent-encoded payload. The reported vector is network-accessible and requires neither authentication nor user interaction.
What can successful exploitation enable?
Invalid or overlong percent-encoded sequences can be decoded into ASCII metacharacters, potentially bypassing platform decoder validation. Downstream processing may then allow path-traversal or CRLF injection sequences, with low reported confidentiality and integrity impact.
How can I determine whether my application is affected?
Check whether it includes uri-js version 4.4.1 or earlier. Prioritize applications that use uri-js to decode externally supplied URI components before using them in paths, headers, or other downstream processing.