CVE-2026-45822 Details
Description
decode-uri-component through 0.4.1 is vulnerable to denial of service. The decode() function splits input on '%' producing N tokens and calls decodeComponents(), exhibiting super-linear parsing time: 200 '%ab' tokens takes approximately 0.7s, 700 tokens approximately 6s, and 1400 tokens approximately 33s. An attacker can cause significant CPU consumption and event-loop blocking via crafted input.
A denial-of-service vulnerability has been identified in the decode-uri-component library, affecting versions through 0.4.1. The issue arises in the decode() function, which processes input by splitting it on '%' and generating multiple tokens. This approach leads to super-linear parsing times, with an attacker able to craft input that significantly increases CPU usage and blocks the event loop. For example, 200 '%ab' tokens take about 0.7 seconds to process, while 1400 tokens can take approximately 33 seconds.
Users can upgrade to decode-uri-component version 0.5.0 or later, where this vulnerability has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Jun 30, 2026CISA-ADP
Assessed Jun 30, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/SamVerschueren/decode-uri-component/blob/00662938dc7c6241547ae8abce7785cc13ffd3f6/index.js | seal | Source CodeVendor |
| https://github.com/SamVerschueren/decode-uri-component/commit/fa479dafeede7bedf04e5c89aa78f2a78c664005 | seal | Source CodeVendor |
| https://www.npmjs.com/package/decode-uri-component | seal | Permission RequiredVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-400 | Uncontrolled Resource Consumption | seal |
| CWE-407 | Inefficient Algorithmic Complexity | seal |
Affected Products
| Product | Versions |
|---|---|
| SamVerschueren decode-uri-component | <= 0.4.1 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 30, 2026 | CVE Modified | CISA-ADP |
| Jun 30, 2026 | New CVE Received | seal |