CVE-2026-93751

uri-js through 4.4.1 Improper UTF-8 Decoding via pctDecChars

At a glance

Severity: MEDIUM 6.9
EPSS: EPSS 0.40 % · percentile 34 (2026-10-27)
State: PUBLISHED
Published: 2026-09-18
Updated: 2026-09-24
Assigner: VulnCheck
NVD status: Awaiting Analysis

Description

uri-js through 4.4.1 contains an improper UTF-8 decoding vulnerability in pctDecChars() that decodes invalid and overlong percent-encoded sequences into ASCII metacharacters. Attackers can craft percent-encoded payloads to bypass platform decoder validation and inject path traversal or CRLF sequences that downstream consumers process without filtering.

Scores

Version	Score	Vector	Scored by
CVSS 4.0	MEDIUM 6.9	CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N	VulnCheck
CVSS 3.1	MEDIUM 6.5	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N	VulnCheck
CVSS 4.0	MEDIUM 6.9	CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X	NVD · disclosure@vulncheck.com (Secondary)
CVSS 3.1	MEDIUM 6.5	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N	NVD · disclosure@vulncheck.com (Secondary)

Weaknesses (CWE)

CWE-176

European references

ENISA EUVD · EUVD-2026-83256
GCVE · GCVE-0-2026-93751

CERT-FR advisories

CERTFR-2026-AVI-1378 — Multiples vulnérabilités dans les produits IBM · cert.ssi.gouv.fr

Affected products

Product	Versions
garycourt · uri-js	affected 0 ≤ 4.4.1

References

Sources

Source	Licence
CVE List (CVEProject cvelistV5)	CVE Program Terms of Use
EPSS (FIRST.org)	FIRST — attribution requested
ENISA EUVD	ENISA — reproduction authorised, source acknowledged
CERT-FR (ANSSI)	Licence Ouverte / Etalab 2.0
NVD (NIST) via fkie-cad/nvd-json-data-feeds	Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD