uri-js through 4.4.1 Denial of Service via removeDotSegments

These records connect through source-stated identifiers. Shared identifiers or dates alone do not establish shared exposure, root cause or applicability.

CVE-2026-93690 · Microsoft / collected KEV context

cve-program · CVE-2026-93690

• https://github.com/garycourt/uri-js/issues/105
• https://github.com/garycourt/uri-js
• https://github.com/garycourt/uri-js/blob/4.4.0/src/uri.ts#L349
• https://github.com/garycourt/uri-js/blob/4.4.0/src/uri.ts#L352-L376
• https://www.npmjs.com/package/uri-js/v/4.4.1
• https://www.vulncheck.com/advisories/uri-js-through-4.4.1-denial-of-service-via-removedotsegments

• Crowd Data Center: DoS (Denial of Service) uri-js Dependency (CVE-2026-93690) · Security advisory · 20 Oct 2026