CVE-2026-93751: uri-js Path Traversal Vulnerability

CVE-2026-93751 Overview

CVE-2026-93751 is an improper UTF-8 decoding vulnerability [CWE-176] in the uri-js JavaScript library through version 4.4.1. The pctDecChars() function decodes invalid and overlong percent-encoded sequences into ASCII metacharacters. Attackers craft percent-encoded payloads that pass platform decoder validation, then inject path traversal or Carriage Return Line Feed (CRLF) sequences into downstream consumers. Because uri-js is a widely used Uniform Resource Identifier (URI) parser in the Node.js ecosystem, the flaw can influence request routing, log integrity, and file access decisions in dependent applications.

Critical Impact
Attackers can bypass URI validation to smuggle path traversal (../) and CRLF (\r\n) metacharacters into downstream parsers, enabling request tampering and unauthorized resource access.

Affected Products

uri-js versions through 4.4.1
Node.js applications that rely on uri-js for URI normalization or validation
Downstream libraries that consume decoded URI components without additional sanitization

Discovery Timeline

2026-09-18 - CVE-2026-93751 published to the National Vulnerability Database (NVD)
2026-09-22 - Last updated in NVD database

Technical Details for CVE-2026-93751

Vulnerability Analysis

The uri-js library exposes pctDecChars() to convert percent-encoded byte sequences back into their decoded character representation. The function does not reject invalid or overlong UTF-8 encodings. RFC 3629 forbids overlong forms because multiple byte sequences can decode to the same code point, creating parser ambiguity.

When an attacker supplies an overlong sequence such as a two-byte or three-byte encoding for a character that fits in a single byte, pctDecChars() still resolves it to an ASCII metacharacter. This produces /, ., \r, or \n bytes after normalization even though the raw input passed initial validation. Consumers that inspect the input before decoding, or that rely on uri-js output as trusted, then process attacker-controlled control characters.

Root Cause

The defect stems from missing validation of UTF-8 byte sequences during percent-decoding. The implementation in src/uri.ts (lines 103-141) accepts any byte pattern that superficially conforms to UTF-8 continuation rules without enforcing the minimum encoding length for each code point. Overlong encodings and invalid continuation bytes decode to characters the caller assumed were filtered.

Attack Vector

An attacker sends a URI containing an overlong percent-encoded sequence to any endpoint that parses input with uri-js. Validation layers see benign multi-byte sequences and forward the request. After uri-js decodes the URI, the resulting string contains path separators, dot segments, or CRLF bytes. Downstream code performs file access, HTTP header construction, or log writes using the tainted output. See the Vulncheck Advisory for uri-js and GitHub URI.js Issue #106 for reproduction details.

Detection Methods for CVE-2026-93751

Indicators of Compromise

Inbound HTTP requests containing overlong percent-encoded byte sequences such as %C0%AE, %C0%AF, or %E0%80%AE where a single-byte encoding is expected
Application logs containing decoded path traversal segments (../) that were not present in raw request URIs
Log entries with injected CRLF bytes producing split or duplicated log lines
Downstream file access outside the intended web root originating from uri-js consumers

Detection Strategies

Perform Software Composition Analysis (SCA) across Node.js projects to flag uri-js versions at or below 4.4.1 in direct and transitive dependencies
Compare pre-decode and post-decode URI values at the application boundary and alert when metacharacters appear only after decoding
Deploy Web Application Firewall (WAF) rules that reject requests containing overlong UTF-8 percent-encodings

Monitoring Recommendations

Track invocations of URI.parse() and related uri-js APIs with instrumentation to capture inputs that expand metacharacter counts after decoding
Correlate anomalous URI patterns with downstream file, header, or log write operations for the same request identifier
Ingest application and reverse proxy logs into a centralized analytics tier to hunt for CRLF injection and traversal patterns at scale

How to Mitigate CVE-2026-93751

Immediate Actions Required

Inventory all Node.js applications and container images that ship uri-js as a direct or transitive dependency
Replace uri-js with a maintained URI parser that enforces RFC 3629 UTF-8 validation, or apply an internal fork with strict decoding
Add explicit post-decode validation that rejects .., /, and CRLF characters where they are not expected

Patch Information

The uri-js project is unmaintained as reflected in GitHub URI.js Issue #106, and no upstream patch has been published at the time of NVD publication. Consult the uri-js GitHub repository and the affected source file for the vulnerable code path. Community forks and alternative libraries such as WHATWG URL should be evaluated as replacements.

Workarounds

Wrap uri-js calls with a validator that rejects overlong UTF-8 percent-encodings before decoding
Canonicalize decoded paths with path.resolve() and confirm the result stays within an allow-listed base directory
Strip or reject \r and \n characters from any string used to build HTTP headers or log entries
Restrict application file access to the minimum required directory tree using operating system permissions

bash

# Configuration example
# Audit Node.js projects for vulnerable uri-js versions
npm ls uri-js
npm audit --production

# Override transitive dependency in package.json
# "overrides": { "uri-js": "npm:@ungap/uri@^1.0.0" }