CVE-2022-0613: Authorization Bypass Through User-Controlled Key in urijs
Summary
CVE-2022-0613: Authorization Bypass Through User-Controlled Key in urijs. Affects urijs versions < 1.19.8. Fixed in 1.19.8. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The urijs package is an npm package that provides a simple and convenient way to manipulate URIs (Uniform Resource Identifiers) in JavaScript. It allows developers to parse, manipulate, and generate URIs for various purposes. However, a vulnerability has been discovered in urijs that allows an attacker to bypass authorization through a user-controlled key.
Vulnerability Detail
The vulnerability (CVE-2022-0613) in urijs allows an attacker to exploit case-insensitive protocol schemes like HTTP, htTP, HTtp, etc. to bypass the patch for CVE-2021-3647. By using these case-insensitive schemes, an attacker can bypass the authorization mechanism and gain unauthorized access to resources. This vulnerability has a CVSS score of 6.5, indicating a moderate severity level. It can potentially lead to unauthorized data access, privilege escalation, or other security breaches.
How To Fix
Latest published version: 1.19.11 as of 23 Oct 2026
npm install urijs@1.19.11Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
1.19.8
This is the first release that contains the fix.
npm install urijs@1.19.8Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is recommended to update the urijs package to the latest version as soon as possible.
Conclusion
The vulnerability in urijs (CVE-2022-0613) allows an attacker to bypass authorization and gain unauthorized access to resources. It is crucial for developers to update the urijs package to version 1.19.8 or later to mitigate this vulnerability. For further support on vulnerability remediation, you can reach out to DevNack.com.
See every vulnerability recorded for urijs →
FAQ
This vulnerability allows an attacker to bypass authorization and gain unauthorized access to resources, potentially leading to data breaches or privilege escalation.
You can use the Vulert Playground (https://vulert.com/scanner) to check if your application is affected by this vulnerability. It analyzes your package-lock.json file and alerts you in real-time for any open-source vulnerabilities, including this one.
Yes, the CVSS score for this vulnerability is 6.5, indicating a moderate severity level.
No, there are no known workarounds for this vulnerability. It is recommended to update the urijs package to the latest version.
For more information about this vulnerability, you can refer to the GitHub Advisory Database (https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/02/GHSA-gcv8-gh4r-25x6/GHSA-gcv8-gh4r-25x6.json).
Related vulnerabilities
Recent vulnerabilities recorded for urijs.
