validator-ajv8-5.13.2.tgz: 3 vulnerabilities (highest severity is: 7.5) #440

Vulnerable Library - validator-ajv8-5.13.2.tgz

Sample Path to Dependency File: /playground/package.json

Path to vulnerable library: /playground/package.json

Found in HEAD commit: 2c2e4a13b710ceb8f65cd32664895e4278834389

CVE-2026-93690

Vulnerable Library - uri-js-4.4.1.tgz

An RFC 3986/3987 compliant, scheme extendable URI/IRI parsing/validating/resolving library for JavaScript.

Library home page: https://registry.npmjs.org/uri-js/-/uri-js-4.4.1.tgz

Sample Path to Dependency File: /playground/package.json

Path to vulnerable library: /playground/package.json

Dependency Hierarchy:

• validator-ajv8-5.13.2.tgz (Root Library)
  • ajv-8.12.0.tgz
    • ❌ uri-js-4.4.1.tgz (Vulnerable Library)

Found in HEAD commit: 2c2e4a13b710ceb8f65cd32664895e4278834389

Found in base branch: develop

Vulnerability Details

uri-js through 4.4.1 contains a denial of service vulnerability in the removeDotSegments function that loops infinitely when a path segment begins with Unicode line or paragraph separators. Attackers can trigger this by calling removeDotSegments directly or through normalize/resolve functions with IRI handling enabled, causing the Node.js event loop to block indefinitely until heap exhaustion.

Publish Date: 2026-09-18

URL: CVE-2026-93690

CVSS 3 Score Details (7.5)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: None
  • Availability Impact: High

Step up your Open Source Security Game with Mend here

CVE-2026-93751

Vulnerable Library - uri-js-4.4.1.tgz

An RFC 3986/3987 compliant, scheme extendable URI/IRI parsing/validating/resolving library for JavaScript.

Library home page: https://registry.npmjs.org/uri-js/-/uri-js-4.4.1.tgz

Sample Path to Dependency File: /playground/package.json

Path to vulnerable library: /playground/package.json

Dependency Hierarchy:

• validator-ajv8-5.13.2.tgz (Root Library)
  • ajv-8.12.0.tgz
    • ❌ uri-js-4.4.1.tgz (Vulnerable Library)

Found in HEAD commit: 2c2e4a13b710ceb8f65cd32664895e4278834389

Found in base branch: develop

Vulnerability Details

uri-js through 4.4.1 contains an improper UTF-8 decoding vulnerability in pctDecChars() that decodes invalid and overlong percent-encoded sequences into ASCII metacharacters. Attackers can craft percent-encoded payloads to bypass platform decoder validation and inject path traversal or CRLF sequences that downstream consumers process without filtering.

Publish Date: 2026-09-18

URL: CVE-2026-93751

CVSS 3 Score Details (6.5)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: Low
  • Integrity Impact: Low
  • Availability Impact: None

Step up your Open Source Security Game with Mend here

CVE-2026-103387

Vulnerable Library - uri-js-4.4.1.tgz

An RFC 3986/3987 compliant, scheme extendable URI/IRI parsing/validating/resolving library for JavaScript.

Library home page: https://registry.npmjs.org/uri-js/-/uri-js-4.4.1.tgz

Sample Path to Dependency File: /playground/package.json

Path to vulnerable library: /playground/package.json

Dependency Hierarchy:

• validator-ajv8-5.13.2.tgz (Root Library)
  • ajv-8.12.0.tgz
    • ❌ uri-js-4.4.1.tgz (Vulnerable Library)

Found in HEAD commit: 2c2e4a13b710ceb8f65cd32664895e4278834389

Found in base branch: develop

Vulnerability Details

A weakness has been identified in garycourt uri-js up to 4.4.1. This affects the function URI.parse of the file src/schemes/mailto.ts of the component Mailto Header Handler. This manipulation of the argument to causes uncaught exception. The attack may be initiated remotely. The exploit has been made available to the public and could be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.

Publish Date: 2026-09-30

URL: CVE-2026-103387

CVSS 3 Score Details (4.3)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: Required
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: None
  • Availability Impact: Low

Step up your Open Source Security Game with Mend here