Hi,

The following vulnerability was published for node-uri-js.

CVE-2026-103387[0]:
| A weakness has been identified in garycourt uri-js up to 4.4.1. This
| affects the function URI.parse of the file src/schemes/mailto.ts of
| the component Mailto Header Handler. This manipulation of the
| argument to causes uncaught exception. The attack may be initiated
| remotely. The exploit has been made available to the public and
| could be used for attacks. The project was informed of the problem
| early through an issue report but has not responded yet.


If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2026-103387
https://www.cve.org/CVERecord?id=CVE-2026-103387
[1] https://github.com/garycourt/uri-js/issues/103

Regards,
Salvatore