CVE-2026-118664 Details
Description
decode-uri-component provides a more robust alternative to decodeURIComponent. Prior to 0.5.1, decodeUriComponent in index.js falls back to customDecodeURIComponent after native decoding throws, and the fallback collects every distinct percent-encoded run before performing a full-string regular-expression replacement for each entry. Malformed input containing many distinct runs can therefore make both the number of replacements and the scanned input length grow together, causing quadratic CPU consumption and blocking the Node.js event loop; request-body inputs can reach the demonstrated size, while ordinary URL header limits reduce the practical delay. This issue is fixed in version 0.5.1.
A denial-of-service vulnerability has been identified in the decode-uri-component package, specifically in versions prior to 0.5.1. The issue arises in the decodeUriComponent function, which, before version 0.5.1, relied on a fallback decoding method that improperly handled malformed percent-encoded input. This flaw allowed distinct runs of percent-encoded characters to be processed inefficiently, leading to quadratic time complexity. As a result, an attacker could craft an input that, while within normal URL header limits, caused significant delays by blocking the Node.js event loop for an extended period. The vulnerability is particularly concerning for applications that decode request bodies, where the impact can be fully realized.
Users can upgrade to decode-uri-component version 0.5.1 or later, where this vulnerability has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 28, 2026CISA-ADP
Assessed Oct 29, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/SamVerschueren/decode-uri-component/commit/fad01d65b93bd3f2f0dc32dfd8d57a38b57bc608 | [email protected] | Source CodeVendor |
| https://github.com/SamVerschueren/decode-uri-component/releases/tag/v0.5.1 | [email protected] | Release NotesVendor |
| https://github.com/SamVerschueren/decode-uri-component/security/advisories/GHSA-qr28-fpjm-wq7f | [email protected] | AdvisoryExploitRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-400 | Uncontrolled Resource Consumption | [email protected] |
| CWE-407 | Inefficient Algorithmic Complexity | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| SamVerschueren decode-uri-component | <= 0.5.0 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 29, 2026 | CVE Modified | CISA-ADP |
| Oct 28, 2026 | New CVE Received | [email protected] |