Detections
Analytics
SCA: security update for uri-js (GHSA-333w-rxj3-f55r)
medium Tenable Cloud Security Plugin ID 422754
Description
There are packages installed that are affected by a vulnerability referenced in the following CVE:- uri-js is a module that tries to fully implement RFC 3986. One of these features is validating whether or
not a supplied URL is valid or not. To do this, uri-js uses a regular expression, This regular expression
is vulnerable to redos. This causes the program to hang and the CPU to idle at 100% usage while uri-js is
trying to validate if the supplied URL is valid or not. To check if you're vulnerable, look for a call to
`require("uri-js").parse()` where a user is able to send their own input. This affects uri-js 2.1.1 and
earlier. (CVE-2017-16021)
See Also
Plugin Details
Severity: Medium
ID: 422754
Version: Revision 1.3
Type: Local
Family: SCA Checks
Published: 3/29/2025
Updated: 7/6/2026
Supported Sensors: Tenable Cloud Security, Tenable Self-Hosted Container Security
Risk Information
VPR
Risk Factor: Low
Score: 3
Percentile: 23.18
Vendor
Vendor Severity: Medium
CVSS v2
Risk Factor: Medium
Base Score: 6.8
Temporal Score: 5.3
Vector: CVSS2#AV:N/AC:L/Au:S/C:N/I:N/A:C
CVSS Score Source: CVE-2017-16021
CVSS v3
Risk Factor: Medium
Base Score: 6.5
Temporal Score: 5.9
Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Temporal Vector: CVSS:3.0/E:P/RL:O/RC:C
Vulnerability Information
Exploit Available: true
Exploit Ease: Exploits are available
Patch Publication Date: 7/24/2018
Vulnerability Publication Date: 4/15/2016
Reference Information
CVE: CVE-2017-16021