High severity7.5NVD Advisory· Published Sep 18, 2026· Updated Sep 22, 2026

CVE-2026-93690

Description

uri-js through 4.4.1 contains a denial of service vulnerability in the removeDotSegments function that loops infinitely when a path segment begins with Unicode line or paragraph separators. Attackers can trigger this by calling removeDotSegments directly or through normalize/resolve functions with IRI handling enabled, causing the Node.js event loop to block indefinitely until heap exhaustion.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

Garycourt/Uri Jsllm-fuzzy
Range: <=4.4.1
Npm/uri-jsllm-create
Range: <=4.4.1

Patches

Vulnerability mechanics

References

github.com/garycourt/uri-js/blob/4.4.0/src/uri.tsnvd
github.com/garycourt/uri-js/blob/4.4.0/src/uri.tsnvd
github.com/garycourt/uri-js/issues/105nvd
www.npmjs.com/package/uri-js/v/4.4.1nvd
www.vulncheck.com/advisories/uri-js-through-4.4.1-denial-of-service-via-removedotsegmentsnvd

News mentions

No linked articles in our index yet.

cvss	0.488
epss	0.000
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000