CVE-2022-1233: URL Confusion When Scheme Not Supplied in urijs
Summary
CVE-2022-1233: URL Confusion When Scheme Not Supplied in medialize/uri.js. Affects urijs versions < 1.19.11. Fixed in 1.19.11. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
urijs is a JavaScript URL mutation library used for parsing and manipulating URLs. It provides various functions to handle URL components such as scheme, hostname, path, etc. The library is commonly used in web development projects to work with URLs. However, a vulnerability has been discovered in urijs that can lead to URL confusion when a scheme is not supplied. This vulnerability affects versions prior to 1.19.11.
Vulnerability Detail
The vulnerability arises when parsing a URL without a scheme and with excessive slashes (e.g., ///www.example.com). In such cases, urijs incorrectly parses the hostname as null and the path as /www.example.com. This behavior differs from how browsers handle such URLs, as they would parse ///www.example.com as http://www.example.com. The consequence of this vulnerability is that it can lead to incorrect URL parsing and potentially cause a redirect to an unintended destination.
How To Fix
Latest published version: 1.19.11 as of 23 Oct 2026
npm install urijs@1.19.11The newest release already contains this fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If updating the package is not feasible, a workaround for this vulnerability is to manually handle URL parsing and manipulation using built-in JavaScript functions or other trusted libraries that correctly handle URLs. Here is an example of how to parse a URL without relying on urijs:
const url = '//www.example.com';
const parsedUrl = new URL(url);
console.log(parsedUrl.href);
Conclusion
The URL confusion vulnerability in urijs can lead to incorrect parsing of URLs and potential redirects to unintended destinations. It is crucial to update the urijs package to version 1.19.11 or later to fix this vulnerability. If updating is not feasible, developers should consider using alternative methods for URL parsing and manipulation. For further assistance and support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for urijs →
FAQ
urijs is a JavaScript library used for parsing and manipulating URLs. It provides convenient functions to work with URL components such as scheme, hostname, path, etc.
The vulnerability can lead to URL confusion and incorrect parsing of URLs. This can potentially result in redirects to unintended destinations and impact the security and functionality of web applications.
You can use the Vulert Playground at Vulert Scanner to check if your application is affected by this vulnerability. Simply provide your package-lock.json file and the playground will analyze it for vulnerabilities in real-time.
Yes, a fix is available in version 1.19.11 of the urijs package. It is recommended to update to this version to mitigate the vulnerability.
If updating the package is not possible, a workaround is to manually handle URL parsing and manipulation using built-in JavaScript functions or other trusted libraries that correctly handle URLs.
Related vulnerabilities
Recent vulnerabilities recorded for urijs.
