Most recent entries from all

cnvd-2022-19502

EUVD-2026-232789

fkie_cve-2022-24723

URI.js is a Javascript URL mutation library. Before version 1.19.9, whitespace characters are not removed from the beginning of the protocol, so URLs are not parsed properly. This issue has been patched in version 1.19.9. Removing leading whitespace from values before passing them to URI.parse can be used as a workaround.

GHSA-gmv4-r438-p67f — Leading white space bypasses protocol validation

Affected: npm: urijs

### Impact Whitespace characters are not removed from the beginning of the protocol, so URLs are not parsed properly and protocol validation mechanisms may fail.

### Patches Patched in 1.19.9

### Workarounds Remove leading whitespace from values before passing them to URI.parse (e.g. via `.href(value)` or `new URI(value)`), e.g. by using

```js function remove_whitespace(url){ const whitespace = /^[\x00-\x20\u00a0\u1680\u2000-\u200a\u2028\u2029\u202f\u205f\u3000\ufeff]+/; url = url.replace(whitespace, '') return url } ```

### References * https://huntr.dev/bounties/82ef23b8-7025-49c9-b5fc-1bb9885788e5/

### For more information If you have any questions or comments about this advisory: * Open an issue in [medialize/URI.js](https://github.com/medialize/URI.js/)

gsd-2022-24723

RHSA-2022:1681 — Red Hat Security Advisory: Red Hat Advanced Cluster Management 2.4.4 security updates and bug fixes

vm2: vulnerable to Sandbox Bypass golang.org/x/crypto: empty plaintext packet causes panic follow-redirects: Exposure of Private Personal Information to an Unauthorized Actor node-fetch: exposure of sensitive information to an unauthorized actor follow-redirects: Exposure of Sensitive Information via Authorization Header leak urijs: Authorization Bypass Through User-Controlled Key cross-fetch: Exposure of Private Personal Information to an Unauthorized Actor nconf: Prototype pollution in memory store nats-server: misusing the "dynamically provisioned sandbox accounts" feature authenticated user can obtain the privileges of the System account urijs: Leading white space bypasses protocol validation node-forge: Signature verification leniency in checking `digestAlgorithm` structure can lead to signature forgery node-forge: Signature verification failing to check tailing garbage bytes can lead to signature forgery node-forge: Signature verification leniency in checking `DigestInfo` structure Moment.js: Path traversal in moment.locale

UBUNTU-CVE-2022-24723

Affected: Ubuntu:20.04:LTS: node-uri-js, Ubuntu:22.04:LTS: node-uri-js, Ubuntu:24.04:LTS: node-uri-js, Ubuntu:25.10: node-uri-js, Ubuntu:26.04:LTS: node-uri-js