URIjs Vulnerable to Hostname spoofing via backslashes in URLGHSA-89gv-h8wf-cg8r
MEDIUMFix: medialize/URI.js#233GHSA-89gv-h8wf-cg8r is a medium-severity (CVSS 5.3) Open Redirect vulnerability in urijs. 1 public exploit or proof-of-concept reference is indexed, so weaponization risk is real. A fix is available for urijs — see the affected versions and patch details below.
EPSS Exploitation Probability
Probability of exploitation in the next 30 days, from FIRST.org EPSS.
How urgent is this, really
Where this sits among everything scored
Real-World Exposure
How broadly this vulnerability is actually deployed: weekly install volume shows current usage, and reverse-dependency count shows how many other packages break if it stays unpatched.
urijsnpmDescription
Impact
If using affected versions to determine a URL's hostname, the hostname can be spoofed by using a combination of backslash (\) and slash (/) characters as part of the scheme delimiter, e.g. scheme:/\/\/\hostname. If the hostname is used in security decisions, the decision may be incorrect.
Depending on library usage and attacker intent, impacts may include allow/block list bypasses, SSRF attacks, open redirects, or other undesired behavior.
Example URL: https:/\/\/\expected-example.com/path
Escaped string: https:/\\/\\/\\expected-example.com/path (JavaScript strings must escape backslash)
Affected versions incorrectly return no hostname. Patched versions correctly return expected-example.com. Patched versions match the behavior of other parsers which implement the WHATWG URL specification, including web browsers and Node's built-in URL class.
Patches
Version 1.19.7 is patched against all known payload variants.
References
https://github.com/medialize/URI.js/releases/tag/v1.19.7 (fix for this particular bypass) https://github.com/medialize/URI.js/releases/tag/v1.19.6 (fix for related bypass) https://github.com/medialize/URI.js/releases/tag/v1.19.4 (fix for related bypass) https://github.com/medialize/URI.js/releases/tag/v1.19.3 (fix for related bypass) PR #233 (initial fix for backslash handling)
For more information
If you have any questions or comments about this advisory, open an issue in https://github.com/medialize/URI.js
Reporter credit
Affected Packages
| Ecosystem | Package | Vulnerable range | Fix |
|---|---|---|---|
| 📦npm | urijs | all versions | 1.19.7npm install urijs@1.19.7 |
Affected Products
uri.jsuri.js_projectResearch use only. For defensive security, authorized penetration testing, and academic research only. Never execute exploit code against systems without explicit written authorization.
Detection & mitigation playbook
Open-source dependencyDetect
Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for urijs, including transitive dependencies — a direct dependency you never call can still pull in a vulnerable version.
Fix
Update urijs to 1.19.7 or later, then make sure no transitive (indirect) dependency still pins the vulnerable range — O3 confirms GHSA-89gv-h8wf-cg8r is resolved across your whole dependency graph.
Workarounds
Stop reflecting attacker-controlled destinations: resolve every redirect target against an allowlist of paths or hosts you own, prefer a server-side key over a full URL in the request, and reject absolute URLs entirely where the flow only ever needs a relative one.
Frequently Asked Questions
Is GHSA-89gv-h8wf-cg8r in your dependencies?
Find it across npm, including transitive dependencies.