PatchTheCVEuri.js vulnerabilities and fixes
Recent CVEs affecting uri.js, with upgrade or downgrade steps. 8 tracked.
Also searched as: uri js, urijs.
uri.js has 8 tracked vulnerabilities, 0 critical. A fixed release or vendor patch exists for 8. Most recent: 2022-04-05. Highest priority: CVE-2021-27516 (score 57/100).
- CVE-2022-24723 MEDIUM 5.3 UPGRADE URI.js is a Javascript URL mutation library
- CVE-2022-1243 MEDIUM 6.1 UPGRADE CRHTLF can lead to invalid protocol extraction potentially leading to XSS in GitHub repository medialize/uri.j
- CVE-2022-1233 MEDIUM 6.1 UPGRADE URL Confusion When Scheme Not Supplied in GitHub repository medialize/uri.js prior to 1.19.11.
- CVE-2022-0868 MEDIUM 6.1 UPGRADE Open Redirect in GitHub repository medialize/uri.js prior to 1.19.10.
- CVE-2022-0613 MEDIUM 6.5 UPGRADE MITIGATE Authorization Bypass Through User-Controlled Key in NPM urijs prior to 1.19.8.
- CVE-2021-3647 MEDIUM 6.1 UPGRADE URI.js is vulnerable to URL Redirection to Untrusted Site
- CVE-2021-27516 HIGH 7.5 UPGRADE URI.js (aka urijs) before 1.19.6 mishandles certain uses of backslash such as http:\/ and interprets the URI a
- CVE-2020-26291 MEDIUM 6.5 UPGRADE URI.js is a javascript URL mutation library (npm package urijs)
FAQ
How do I fix uri.js vulnerabilities?
Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.
Is uri.js being exploited right now?
None of the tracked uri.js CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.
Which uri.js CVE should I patch first?
CVE-2021-27516 currently ranks highest (57/100): URI.js (aka urijs) before 1.19.6 mishandles certain uses of backslash such as http:\/ and interprets the URI a.