CVE-2026-93690

Katalog CVE

CVSS 7.5 · High EPSS 0,68%

Kerentanan Loop with Unreachable Exit Condition ('Infinite Loop'). Skor CVSS 3.1 7.5 (High) menurut vulncheck.com.

Deskripsi (NVD)

uri-js through 4.4.1 contains a denial of service vulnerability in the removeDotSegments function that loops infinitely when a path segment begins with Unicode line or paragraph separators. Attackers can trigger this by calling removeDotSegments directly or through normalize/resolve functions with IRI handling enabled, causing the Node.js event loop to block indefinitely until heap exhaustion.

Rincian

Terbit di NVD

18 September 2026

Terakhir diubah

22 September 2026

Status NVD

Awaiting Analysis

CVSS 3.1

7.5 (High), sumber vulncheck.com
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-835: Loop with Unreachable Exit Condition ('Infinite Loop')

EPSS (30 hari)

0,68% peluang dieksploitasi; lebih tinggi dari 51,3% CVE lain

Produk dan versi terdampak

NVD belum mencantumkan data produk (CPE) untuk CVE ini. Produk yang terdampak biasanya disebut di deskripsi dan di advisory vendor pada daftar referensi.

Referensi dan perbaikan

• https://github.com/garycourt/uri-js
• https://github.com/garycourt/uri-js/blob/4.4.0/src/uri.ts#L349
• https://github.com/garycourt/uri-js/blob/4.4.0/src/uri.ts#L352-L376
• https://github.com/garycourt/uri-js/issues/105
• https://www.npmjs.com/package/uri-js/v/4.4.1
• https://www.vulncheck.com/advisories/uri-js-through-4.4.1-denial-of-service-via-removedotsegments