CVE-2026-93690— uri-js through 4.4.1 Denial of Service via removeDotSegments

Quick assessment

Affected

garycourt uri-js

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

uri-js 库从发布版本至 4.4.1 存在一个拒绝服务（DoS）漏洞，位于函数中。当路径片段以 Unicode 行分隔符或段落分隔符开头时，该函数会陷入无限循环。攻击者可以直接调用，或通过启用 IRI 处理机制的或函数来触发此漏洞，导致 Node.js 事件循环被无限阻塞，直至堆内存耗尽。

CVSS 7.5 · High EPSS 0.45% · P39 Updated Sep 28, 2026

Possible ATT&CK Techniques 3 AI

T1029 · Scheduled Transfer T1499 · Endpoint Denial of Service T1190 · Exploit Public-Facing Application

Affected Version Matrix 1

Vendor	Product	Version Range	Status
garycourt	uri-js	`≤ 4.4.1`	affected

Get alerts for future matching vulnerabilities Log in to subscribe

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

uri-js through 4.4.1 Denial of Service via removeDotSegments

Source: CVE Program / CVE List V5

Vulnerability Description

uri-js through 4.4.1 contains a denial of service vulnerability in the removeDotSegments function that loops infinitely when a path segment begins with Unicode line or paragraph separators. Attackers can trigger this by calling removeDotSegments directly or through normalize/resolve functions with IRI handling enabled, causing the Node.js event loop to block indefinitely until heap exhaustion.

Source: CVE Program / CVE List V5

CVSS Information

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Source: CVE Program / CVE List V5

Vulnerability Type

不可达退出条件的循环(无限循环)

Source: CVE Program / CVE List V5

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
garycourt	uri-js	0 ~ 4.4.1	-

II. Public POCs for CVE-2026-93690

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-93690

请登录查看更多情报信息。

Other References for CVE-2026-93690 (5)

🔗 uri-js/src/uri.ts at 4.4.0 · garycourt/uri-js · GitHub Read full article technical-description
🔗 uri-js/src/uri.ts at 4.4.0 · garycourt/uri-js · GitHub technical-description
🔗 GitHub - garycourt/uri-js: An RFC 3986 compliant, scheme extendable URI parsing/validating/normalizing/resolving library for JavaScript · GitHub product
🔗 Security Advisory: Unicode line separators cause an infinite loop and unbounded memory growth in removeDotSegments · Issue #105 · garycourt/uri-js Read full article issue-tracking
🔗 uri-js through 4.4.1 Denial of Service via removeDotSegments | Advisories | VulnCheck third-party-advisory

https://www.cve.org/CVERecord?id=CVE-2026-93690

IV. Related Vulnerabilities

Same product: uri-js

Same vendor: garycourt

Same weakness: CWE-835