CVE-2026-118664

HighCVSS 8.2

Published: 28/10/2026(UTC)Updated: 29/10/2026(UTC)Translated: 28/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.32%

25th percentile - higher than 25% of all known CVEs

Summary

Prior to 0.5.1, decodeUriComponent in decode-uri-component falls back to customDecodeURIComponent after native decoding throws, and the fallback collects every distinct percent-encoded run before performing a full-string regular-expression replacement for each entry. Malformed input containing many distinct runs can cause quadratic CPU consumption and block the Node.js event loop.

Risk Assessment

An attacker can cause a denial of service by blocking the Node.js event loop, leading to service unavailability.

Recommendation

Update decode-uri-component to version 0.5.1 or later. Consider limiting the size of input processed by this function.

Other vulnerabilities in decode-uri-component

CVE-2026-45822Medium
The decode-uri-component library through version 0.4.1 is vulnerable to denial of service (DoS). The decode() function splits input on '%' producing N tokens and calls decodeComponents(), exhibiting super-linear parsing time: 200 '%ab' tokens takes approximately 0.7s, 700 tokens approximately 6s, and 1400 tokens approximately 33s. An attacker can cause significant CPU consumption and event-loop blocking via crafted input.

Original NVD description (English source)

decode-uri-component provides a more robust alternative to decodeURIComponent. Prior to 0.5.1, decodeUriComponent in index.js falls back to customDecodeURIComponent after native decoding throws, and the fallback collects every distinct percent-encoded run before performing a full-string regular-expression replacement for each entry. Malformed input containing many distinct runs can therefore make both the number of replacements and the scanned input length grow together, causing quadratic CPU consumption and blocking the Node.js event loop; request-body inputs can reach the demonstrated size, while ordinary URL header limits reduce the practical delay. This issue is fixed in version 0.5.1.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS