[Pkg-javascript-devel] Bug#1148403: node-uri-js: CVE-2026-93751

[Salvatore Bonaccorso]

Source: node-uri-js
Version: 4.4.0+dfsg-10
Severity: important
Tags: security upstream
Forwarded: https://github.com/garycourt/uri-js/issues/106
X-Debbugs-Cc: carnil at debian.org, Debian Security Team <team at security.debian.org>

Hi,

The following vulnerability was published for node-uri-js.

CVE-2026-93751[0]:
| uri-js through 4.4.1 contains an improper UTF-8 decoding
| vulnerability in pctDecChars() that decodes invalid and overlong
| percent-encoded sequences into ASCII metacharacters. Attackers can
| craft percent-encoded payloads to bypass platform decoder validation
| and inject path traversal or CRLF sequences that downstream
| consumers process without filtering.

TTBOMK, no upstream fix yet exists at time of writing the bugreport.


If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2026-93751
    https://www.cve.org/CVERecord?id=CVE-2026-93751
[1] https://github.com/garycourt/uri-js/issues/106

Please adjust the affected versions in the BTS as needed.

Regards,
Salvatore