CVE-2026-93690 Overview
CVE-2026-93690 is a denial of service vulnerability affecting the uri-js npm package through version 4.4.1. The flaw resides in the removeDotSegments function, which enters an infinite loop when processing path segments that begin with Unicode line or paragraph separators. Attackers can trigger the loop by calling removeDotSegments directly or by invoking normalize or resolve with Internationalized Resource Identifier (IRI) handling enabled. The condition blocks the Node.js event loop indefinitely and drives the process toward heap exhaustion. This weakness is classified under CWE-835: Loop with Unreachable Exit Condition.
Critical Impact
A single crafted URI can stall the Node.js event loop and exhaust process memory, taking down any service that parses untrusted URIs with uri-js.
Affected Products
- uri-js npm package versions up to and including 4.4.1
- Node.js applications invoking normalize or resolve with IRI handling enabled
- Downstream libraries and frameworks that depend on uri-js for URI parsing
Discovery Timeline
- 2026-09-18 - CVE-2026-93690 published to the National Vulnerability Database (NVD)
- 2026-09-22 - Last updated in NVD database
Technical Details for CVE-2026-93690
Vulnerability Analysis
The uri-js library implements URI normalization per RFC 3986 and IRI handling per RFC 3987. The removeDotSegments routine iterates over an input path, stripping . and .. segments according to the specification. When IRI mode expands the character class of valid path characters, Unicode line separator (U+2028) and paragraph separator (U+2029) characters can appear at the start of a segment. The parsing loop fails to advance its cursor when it encounters these separators, so the same segment is evaluated on every iteration.
Because Node.js runs JavaScript on a single event loop thread, the infinite loop halts all other work in the process. Incoming requests queue behind the blocked handler, timers stop firing, and the V8 heap grows as intermediate string allocations accumulate. Heap exhaustion terminates the process with an out-of-memory error. Any HTTP server, worker, or CLI tool that hands attacker-controlled URIs to uri-js is affected.
Root Cause
The root cause is missing termination logic in the removeDotSegments state machine for path segments starting with U+2028 or U+2029. The function relies on segment-prefix matching to decide how many characters to consume. Neither the dot-segment branches nor the default branch match these Unicode separators, so no characters are removed and the loop condition remains true indefinitely.
Attack Vector
Exploitation requires only a crafted URI string reaching a vulnerable uri-js API. The attacker sends the payload through any input surface that flows into URI.normalize, URI.resolve, or a direct removeDotSegments call with IRI options enabled. No authentication, user interaction, or elevated privileges are required, and the attack traverses the network. A single request is sufficient to take a Node.js worker offline. The vulnerability mechanism is documented in the Vulncheck advisory for uri-js and the upstream issue #105. The vulnerable code path is visible in the uri-js 4.4.0 source.
Detection Methods for CVE-2026-93690
Indicators of Compromise
- Node.js worker processes stalled at 100% CPU on a single core with no forward progress on event loop metrics
- Out-of-memory crashes in services that parse URIs, with heap snapshots dominated by string allocations from uri.ts
- HTTP request logs containing URI or Location-style fields with embedded U+2028 or U+2029 characters before a stall
Detection Strategies
- Inventory Node.js applications and enumerate direct and transitive dependencies on uri-js versions at or below 4.4.1 using npm ls uri-js
- Instrument the event loop with perf_hooks or an APM agent and alert on lag exceeding a low threshold such as 1 second
- Add web application firewall (WAF) rules that flag or block URIs containing %E2%80%A8 or %E2%80%A9 in path components
Monitoring Recommendations
- Monitor process memory growth and event loop lag on services that accept URIs from untrusted sources
- Correlate abrupt worker restarts with inbound requests carrying long or unusual URI payloads
- Track dependency drift so that pinned or transitive uri-js versions are reevaluated after each release
How to Mitigate CVE-2026-93690
Immediate Actions Required
- Identify every service that ships uri-js at 4.4.1 or earlier and prioritize internet-facing components
- Deploy input validation that rejects URIs containing U+2028 or U+2029 before they reach uri-js
- Constrain URI parsing operations with timeouts or run them in worker threads that can be terminated on stall
Patch Information
At publication time, uri-js version 4.4.1 remains the latest release on npm and contains the vulnerable removeDotSegments implementation. Review the uri-js npm listing and the upstream repository for future patched releases, and consider migrating to a maintained URI parsing library if a fix is not published in a timeframe acceptable to your organization.
Workarounds
- Wrap calls to URI.normalize and URI.resolve in a worker thread with a hard execution timeout to bound damage from a stalled parser
- Strip or reject Unicode line separator (U+2028) and paragraph separator (U+2029) characters from URI inputs at the ingress layer
- Disable IRI handling in uri-js where feasible, since the infinite loop is reachable through the IRI-aware code paths
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.