Description
uri-js through 4.4.1 contains a denial of service vulnerability in the removeDotSegments function that loops infinitely when a path segment begins with Unicode line or paragraph separators. Attackers can trigger this by calling removeDotSegments directly or through normalize/resolve functions with IRI handling enabled, causing the Node.js event loop to block indefinitely until heap exhaustion.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
garycourt uri-js
Default version status: unaffected
0 to ≤ 4.4.1affected
pkg:npm/uri-jsReferences
- https://github.com/garycourt/uri-js/issues/105 ↗
- https://github.com/garycourt/uri-js ↗
- https://github.com/garycourt/uri-js/blob/4.4.0/src/uri.ts#L349 ↗
- https://github.com/garycourt/uri-js/blob/4.4.0/src/uri.ts#L352-L376 ↗
- https://www.npmjs.com/package/uri-js/v/4.4.1 ↗
- https://www.vulncheck.com/advisories/uri-js-through-4.4.1-denial-of-service-via-removedotsegments ↗