CVE-2022-24723: Open Source Vulnerability in urijs - Leading white space bypasses protocol validation
Summary
CVE-2022-24723: Leading white space bypasses protocol validation. Affects urijs versions < 1.19.9. Fixed in 1.19.9. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The urijs package is an open-source library for parsing, manipulating, and validating URIs (Uniform Resource Identifiers). It provides a comprehensive set of functions for working with URIs in various formats. The package is widely used in JavaScript applications to handle URL-related operations. However, a vulnerability has been discovered in the package that allows leading white space characters to bypass protocol validation mechanisms.
Vulnerability Detail
The vulnerability arises from the failure to remove leading white space characters from the beginning of the protocol in URLs. As a result, URLs are not parsed properly, and protocol validation mechanisms may fail. This can lead to various security issues, such as allowing malicious URLs to be treated as valid and potentially bypassing security measures that rely on proper URL parsing. The impact of this vulnerability can vary depending on how the affected application handles URLs and the context in which they are used.
How To Fix
Latest published version: 1.19.11 as of 23 Oct 2026
npm install urijs@1.19.11Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
1.19.9
This is the first release that contains the fix.
npm install urijs@1.19.9Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If updating the package is not immediately feasible, a workaround can be implemented by removing leading whitespace from values before passing them to the URI.parse function. This can be achieved by using the following JavaScript code:
function removeWhitespace(url) {
const whitespaceRegex = /^[\x00-\x20\u00a0\u1680\u2000-\u200a\u2028\u2029\u202f\u205f\u3000\ufeff]+/;
url = url.replace(whitespaceRegex, '');
return url;
}
This code defines a function removeWhitespace that takes a URL as input and removes any leading whitespace characters using a regular expression. The modified URL can then be passed to the URI.parse function for proper parsing and validation.
Conclusion
The urijs package is vulnerable to a leading white space bypass vulnerability, which can result in improper URL parsing and validation. Developers should update their dependency to the patched version (1.19.9) to mitigate this vulnerability. If immediate update is not possible, a workaround can be implemented by removing leading whitespace from URL values before parsing. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for urijs →
FAQ
The impact of this vulnerability can vary depending on how the affected application handles URLs and the context in which they are used. It can potentially allow malicious URLs to be treated as valid and bypass security measures that rely on proper URL parsing.
Yes, the vulnerability has been patched in version 1.19.9 of the urijs package.
To fix the vulnerability, you should update your dependency on the urijs package to the latest version (1.19.9). This can be done by running the package manager command to update the package or manually updating the package version in your project's configuration file.
Yes, if updating the package is not immediately feasible, you can implement a workaround by removing leading whitespace from URL values before passing them to the URI.parse function. Refer to the provided code snippet in the 'workaround' section for more details.
You can find more information about this vulnerability in the advisory published on the Huntr platform: https://huntr.dev/bounties/82ef23b8-7025-49c9-b5fc-1bb9885788e5/
References
Related vulnerabilities
Recent vulnerabilities recorded for urijs.
