Source: node-uri-js Version: 4.4.0+dfsg-8 X-Debbugs-CC: [email protected] Severity: importnt Tags: security upstream Forwarded: https://github.com/garycourt/uri-js/issues/103
Hi, The following vulnerability was published for node-uri-js. CVE-2026-103387[0]: | A weakness has been identified in garycourt uri-js up to 4.4.1. This | affects the function URI.parse of the file src/schemes/mailto.ts of | the component Mailto Header Handler. This manipulation of the | argument to causes uncaught exception. The attack may be initiated | remotely. The exploit has been made available to the public and | could be used for attacks. The project was informed of the problem | early through an issue report but has not responded yet. If you fix the vulnerability please also make sure to include the CVE (Common Vulnerabilities & Exposures) id in your changelog entry. For further information see: [0] https://security-tracker.debian.org/tracker/CVE-2026-103387 https://www.cve.org/CVERecord?id=CVE-2026-103387 [1] https://github.com/garycourt/uri-js/issues/103 Regards, Salvatore -- Pkg-javascript-devel mailing list [email protected] https://alioth-lists.debian.net/cgi-bin/mailman/listinfo/pkg-javascript-devel
