URIjs Vulnerable to Hostname spoofing via backslashes in URL

Exploitation

No confirmed exploitation recorded. Patch Next marks exploitation only from CISA KEV.

CVSS

5.3 · CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

EPSS

• CVE-2021-3647: 0.91% estimated exploitation activity in the next 30 days; percentile 60.02 (FIRST EPSS, 2026-11-03). This is a model estimate, not proof of exploitation or customer exposure.

As published by the source; long descriptions are shortened.

Impact If using affected versions to determine a URL's hostname, the hostname can be spoofed by using a combination of backslash (\) and slash (/) characters as part of the scheme delimiter, e.g. scheme:/\/\/\hostname. If the hostname is used in security decisions, the decision may be incorrect. Depending on library usage and attacker intent, impacts may include allow/block list bypasses, SSRF attacks, open redirects, or other undesired behavior. Example URL: https:/\/\/\expected-example.com/path Escaped string: https:/\\/\\/\\expected-example.com/path (JavaScript strings must escape backslash) Affected versions incorrectly return no hostname. Patched versions correctly return expected-example.com. Patched versions match the behavior of other parsers which implement the WHATWG URL specification, including web browsers and Node's built-in URL class. Patches Version 1.19.7 is patched against all known payload variants. References https://github.com/medialize/URI.js/releases/tag/v1.19.7…

Published by the source

19 Jul 2021, 21:22 UTC

Last modified by the source

8 Nov 2023, 04:06 UTC

Source last checked

26 Oct 2026, 12:25 UTC

1. Revision 2 · amended · 26 Oct 2026

   Amended from ghsa record GHSA-89gv-h8wf-cg8r

2. Revision 1 · created · 24 Oct 2026

   Published from osv record GHSA-89gv-h8wf-cg8r

Preview the exact text before you copy it. Commands are read-only suggestions; review them before running anything.

# Patch Next advisory brief: CVE-2021-3647

Advisory: URIjs Vulnerable to Hostname spoofing via backslashes in URL
IDs: CVE-2021-3647, GHSA-89gv-h8wf-cg8r
Record: https://patchnext.com/advisories/cve-2021-3647 (revision 2, source checked 26 Oct 2026, 12:25 UTC)
Inventory: none attached. This brief comes from a public page and does not say whether any deployment is affected.
Severity: Medium (CVSS 5.3)
Exploitation: no confirmed exploitation recorded. Patch Next confirms exploitation only from CISA KEV.
Vendor response: Vendor fix available; fixed versions by package: urijs 1.19.7. A vendor fix does not mean a deployment is fixed.

## Affected components
- npm urijs: affected < 1.19.7; fixed in 1.19.7

## Suggested inspection (read-only)
- `npm ls urijs --all`: lists every installed copy and version, including transitive ones. Run in the project root after `npm ci`.

## Supported action
Upgrade each affected component to a fixed version on its release line. For a transitive dependency, upgrade the parent package or add an override or constraint, then regenerate the lockfile. Redeploy every environment that ran an affected version.

## Required regression checks
- Run the test suite and a production build.
- Exercise the features that depend on urijs.
- Repeat the inspection and confirm that only fixed versions remain installed.

## Rollback considerations
- Keep the previous lockfile and deployment artifact. Rolling back reinstates the vulnerable version, so apply any documented mitigation while you fix forward.

## Unresolved questions
- Which deployments run an affected version?
- Exploitation status can change. Check again before lowering the priority.
- Mark the work resolved only after the fixed version is verified in production.

## Sources
- Verified: https://osv.dev/vulnerability/GHSA-89gv-h8wf-cg8r (OSV record GHSA-89gv-h8wf-cg8r lists affected ranges: npm urijs >=0 <1.19.7 (fixed))
- Verified: https://github.com/advisories/GHSA-89gv-h8wf-cg8r (GitHub-reviewed advisory GHSA-89gv-h8wf-cg8r lists affected ranges: npm urijs >=0 <1.19.7)

Commands are suggestions: review each one before running it.