QID 981896

Security update has been released for urijs to fix the vulnerability.

Note: The preceding description block is extracted directly from the security advisory. Using automation, we have attempted to clean and format it as much as possible without introducing additional issues.

If using affected versions to determine a URL's hostname, the hostname can be spoofed by using a combination of backslash (`\`) and slash (`/`) characters as part of the scheme delimiter, e.g. `scheme:/\/\/\hostname`. If the hostname is used in security decisions, the decision may be incorrect.

Depending on library usage and attacker intent, impacts may include allow/block list bypasses, SSRF attacks, open redirects, or other undesired behavior.

Example URL: `https:/\/\/\expected-example.com/path`
Escaped string: `https:/\\/\\/\\expected-example.com/path` (JavaScript strings must escape backslash)

Affected versions incorrectly return no hostname. Patched versions correctly return `expected-example.com`. Patched versions match the behavior of other parsers which implement the [WHATWG URL specification](https://url.spec.whatwg.org/), including web browsers and [Node's built-in URL class](https://nodejs.org/api/url.html).