CVE-2017-16021

MediumCVSS 6.5/10Last modified Jun 17, 2026

Description

uri-js is a module that tries to fully implement RFC 3986. One of these features is validating whether or not a supplied URL is valid or not. To do this, uri-js uses a regular expression, This regular expression is vulnerable to redos. This causes the program to hang and the CPU to idle at 100% usage while uri-js is trying to validate if the supplied URL is valid or not. To check if you're vulnerable, look for a call to `require("uri-js").parse()` where a user is able to send their own input. This affects uri-js 2.1.1 and earlier.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-400 CWE-1333

Affected software

Vendor	Product	Versions
HackerOne	uri-js node module	<=2.1.1

References

https://github.com/garycourt/uri-js/issues/12Exploit, Issue Tracking, Third Party Advisory
https://nodesecurity.io/advisories/100Broken Link, Third Party Advisory
https://github.com/garycourt/uri-js/issues/12Exploit, Issue Tracking, Third Party Advisory
https://nodesecurity.io/advisories/100Broken Link, Third Party Advisory

Timeline

Published: Jun 4, 2018
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2017

CVE-2017-160226.1Morris.js creates an svg graph, with labels that appear when hovering over a point. The hovering label names are not escaped in versions 0.5 CVE-2017-160237.5Decamelize is used to convert a dash/dot/underscore/space separated string to camelCase. Decamelize 1.1.0 through 1.1.1 uses regular express CVE-2017-160246.5The sync-exec module is used to simulate child_process.execSync in node versions <0.11.9. Sync-exec uses tmp directories as a buffer before CVE-2017-160255.9Nes is a websocket extension library for hapi. Hapi is a webserver framework. Versions below and including 6.4.0 have a denial of service vu CVE-2017-160265.9Request is an http client. If a request is made using ```multipart```, and the body type is a ```number```, then the specified number of non CVE-2017-160285.3react-native-meteor-oauth is a library for Oauth2 login to a Meteor server in React Native. The oauth Random Token is generated using a non-CVE-2017-160297.5hostr is a simple web server that serves up the contents of the current directory. There is a directory traversal vulnerability in hostr 2.3 CVE-2017-160307.5Useragent is used to parse useragent headers. It uses several regular expressions to accomplish this. An attacker could edit their own heade CVE-2017-160317.5Socket.io is a realtime application framework that provides communication via websockets. Because socket.io 0.9.6 and earlier depends on `Ma CVE-2017-160358.1The hubl-server module is a wrapper for the HubL Development Server. During installation hubl-server downloads a set of dependencies from ap CVE-2017-160367.5`badjs-sourcemap-server` receives files sent by `badjs-sourcemap`. `badjs-sourcemap-server` is vulnerable to a directory traversal issue, gi CVE-2017-160377.5`gomeplus-h5-proxy` is vulnerable to a directory traversal issue, allowing attackers to access any file in the system by placing '../' in th