Log in Start free

Vulnerability · Published Sep 30, 2026 · Assigned by VulDB

CVE-2026-103387garycourt uri-js Mailto Header mailto.ts URI.parse uncaught exception

Medium 4.3

In plain English

A medium-severity security flaw in uri-js from garycourt. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 25% of all known vulnerabilities).

Severity (CVSS 3.1)4.3Medium
Exploit odds (30 days)0.3%top 75.0% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known

Official description

A weakness has been identified in garycourt uri-js up to 4.4.1. This affects the function URI.parse of the file src/schemes/mailto.ts of the component Mailto Header Handler. This manipulation of the argument to causes uncaught exception. The attack may be initiated remotely. The exploit has been made available to the public and could be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:12node-uri-jsno fix listedDEBIAN-CVE-2026-103387
Debian:13node-uri-jsno fix listedDEBIAN-CVE-2026-103387
Debian:14node-uri-jsno fix listedDEBIAN-CVE-2026-103387
Ubuntu:22.04:LTSnode-uri-jsno fix listedUBUNTU-CVE-2026-103387
Ubuntu:24.04:LTSnode-uri-jsno fix listedUBUNTU-CVE-2026-103387
Ubuntu:26.04:LTSnode-uri-jsno fix listedUBUNTU-CVE-2026-103387
Ubuntu:26.10node-uri-jsno fix listedUBUNTU-CVE-2026-103387

Affected products (as reported)

VendorProductVersions
garycourt uri-js 4.4.04.4.1

Weakness: CWE-248 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L/E:P/RL:X/RC:C

References