Description
uri-js through 4.4.1 contains an improper UTF-8 decoding vulnerability in pctDecChars() that decodes invalid and overlong percent-encoded sequences into ASCII metacharacters. Attackers can craft percent-encoded payloads to bypass platform decoder validation and inject path traversal or CRLF sequences that downstream consumers process without filtering.
Published: 2026-09-18
Score: 6.9 Medium
EPSS: n/a
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Analysis and contextual insights are available on OpenCVE Cloud.

Remediation

No vendor fix or workaround currently provided.

Additional remediation guidance may be available on OpenCVE Cloud.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Fri, 18 Sep 2026 21:30:00 +0000

Type Values Removed Values Added
Description uri-js through 4.4.1 contains an improper UTF-8 decoding vulnerability in pctDecChars() that decodes invalid and overlong percent-encoded sequences into ASCII metacharacters. Attackers can craft percent-encoded payloads to bypass platform decoder validation and inject path traversal or CRLF sequences that downstream consumers process without filtering.
Title uri-js through 4.4.1 Improper UTF-8 Decoding via pctDecChars
First Time appeared Garycourt
Garycourt uri-js
Weaknesses CWE-176
CPEs cpe:2.3:a:garycourt:uri-js:*:*:*:*:*:*:*:*
Vendors & Products Garycourt
Garycourt uri-js
References
Metrics cvssV3_1

{'score': 6.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N'}

cvssV4_0

{'score': 6.9, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N'}

Subscriptions

Garycourt Uri-js
cve-icon MITRE

Status: PUBLISHED

Assigner: VulnCheck

Published:

Updated: 2026-09-18T17:51:36.332Z

Reserved: 2026-09-18T16:30:18.137Z

Link: CVE-2026-93751

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-09-18T18:18:34.177

Modified: 2026-09-18T18:18:34.177

Link: CVE-2026-93751

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

No data.

Weaknesses