Live › vulnerability › CVE-2026-118664
Go to dashboarddecode-uri-component's fallback decoder, used when native decoding throws, runs a full-string regex replacement for every distinct percent-encoded run in the input. Malformed input with many distinct runs makes CPU work grow quadratically and can block the Node.js event loop, a denial of service.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-28 21:35 UTC. All times on this page are UTC.
Node.js services that decode untrusted percent-encoded input with this package, directly or through a dependency that uses it, are exposed. Request bodies can reach the size needed for a noticeable delay, while typical URL header limits reduce the practical impact. Projects that do not install this package, or only run it on trusted input, can skip it.
No product ranges from the sources yet.
npm ls decode-uri-component in each project to find the installed version.package-lock.json, yarn.lock, pnpm-lock.yaml) for decode-uri-component versions below 0.5.1.decode-uri-component to 0.5.1 or later, including transitive copies that libraries pull in.npm ls decode-uri-component.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
decode-uri-component provides a more robust alternative to decodeURIComponent. Prior to 0.5.1, decodeUriComponent in index.js falls back to customDecodeURIComponent after native decoding throws, and the fallback collects every distinct percent-encoded run before performing a full-string regular-expression replacement for each entry. Malformed input containing many distinct runs can therefore make both the number of replacements and the scanned input length grow together, causing quadratic CPU consumption and blocking the Node.js event loop; request-body inputs can reach the demonstrated size, while ordinary URL header limits reduce the practical delay. This issue is fixed in version 0.5.1.
This page as .md · .json · in your agent: get_signal("CVE-2026-118664")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.