CVE-2021-27516: Uri.js Project Uri.js

High severity, CVSS 7.5. EPSS: 2.5% chance of exploitation in the next 30 days.

URI.js (aka urijs) before 1.19.6 mishandles certain uses of backslash such as http:\/ and interprets the URI as a relative path.

Affected products

• Uri.js Project Uri.js: before 1.19.6 (fixed in 1.19.6)

Published 2021-02-22. Last modified 2026-06-17.