{"id":"CVE-2026-118664","kind":"vulnerability","aliases":["CVE-2026-118664"],"related":[],"title":"decode-uri-component: crafted input causes quadratic CPU use and event loop blocking","description":"decode-uri-component provides a more robust alternative to decodeURIComponent. Prior to 0.5.1, decodeUriComponent in index.js falls back to customDecodeURIComponent after native decoding throws, and the fallback collects every distinct percent-encoded run before performing a full-string regular-expression replacement for each entry. Malformed input containing many distinct runs can therefore make both the number of replacements and the scanned input length grow together, causing quadratic CPU consumption and blocking the Node.js event loop; request-body inputs can reach the demonstrated size, while ordinary URL header limits reduce the practical delay. This issue is fixed in version 0.5.1.","summary":"decode-uri-component's fallback decoder, used when native decoding throws, runs a full-string regex replacement for every distinct percent-encoded run in the input. Malformed input with many distinct runs makes CPU work grow quadratically and can block the Node.js event loop, a denial of service.","severity":"high","cvss":8.2,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["node.js","npm","package","self-hosted","web-api"],"not_affected_if":["not-installed","trusted-input-only"],"how_to_check":"- Run `npm ls decode-uri-component` in each project to find the installed version.\n- Check lockfiles (`package-lock.json`, `yarn.lock`, `pnpm-lock.yaml`) for `decode-uri-component` versions below `0.5.1`.","fix":"- Upgrade `decode-uri-component` to `0.5.1` or later, including transitive copies that libraries pull in.\n- Rebuild and redeploy after the upgrade, then confirm with `npm ls decode-uri-component`.","status":"open","published_at":"2026-10-28T21:16:56+00:00","first_seen_at":"2026-10-28T21:35:45+00:00","triaged_at":"2026-10-28T21:36:36+00:00","updated_at":"2026-10-28T21:36:36+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-10-28T21:36:36Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade `decode-uri-component` to `0.5.1` or later, including transitive copies that libraries pull in.\n- Rebuild and redeploy after the upgrade, then confirm with `npm ls decode-uri-component`.","reach":"internet","title":"decode-uri-component: crafted input causes quadratic CPU use and event loop blocking","impact":"medium","summary":"decode-uri-component's fallback decoder, used when native decoding throws, runs a full-string regex replacement for every distinct percent-encoded run in the input. Malformed input with many distinct runs makes CPU work grow quadratically and can block the Node.js event loop, a denial of service.","category":"package","nicknames":[],"who_cares":["node.js","npm","self-hosted","web-api"],"confidence":0.7,"needs_auth":"no","worst_case":"Server event loop blocked by crafted input, causing denial of service","analyst_note":"","how_to_check":"- Run `npm ls decode-uri-component` in each project to find the installed version.\n- Check lockfiles (`package-lock.json`, `yarn.lock`, `pnpm-lock.yaml`) for `decode-uri-component` versions below `0.5.1`.","needs_analyst":false,"not_affected_if":["not-installed","trusted-input-only"],"who_is_affected":"Node.js services that decode untrusted percent-encoded input with this package, directly or through a dependency that uses it, are exposed. Request bodies can reach the size needed for a noticeable delay, while typical URL header limits reduce the practical impact. Projects that do not install this package, or only run it on trusted input, can skip it.","user_interaction":"no","needs_special_setup":"no","severity_if_unknown":"high"},"cost_usd":0.000643,"input_tokens":3426,"output_tokens":600,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-118664':17A,20A '-2026':16A,19A '0.5.1':94C,184C 'altern':89C 'api':29B 'back':99C 'block':14A,72B,155C 'bodi':162C 'caus':7A,150C 'collect':109C 'compon':4A,33B,84C 'consumpt':153C 'contain':131C 'cpu':9A,66B,152C 'craft':5A 'customdecodeuricompon':101C 'cve':15A,18A 'decod':2A,31B,36B,40B,82C,104C 'decode-uri-compon':1A,30B,81C 'decodeuricompon':91C,95C 'delay':177C 'demonstr':167C 'denial':78B 'distinct':51B,63B,111C,133C 'encod':54B,114C 'entri':128C 'event':12A,75B,158C 'everi':50B,110C 'express':124C 'fall':98C 'fallback':35B,108C 'fix':181C 'full':45B,120C 'full-str':44B,119C 'grow':68B,148C 'header':172C 'host':26B 'index.js':97C 'input':6A,58B,60B,130C,146C,163C 'issu':179C 'length':147C 'limit':173C 'loop':13A,76B,159C 'make':65B,137C 'malform':59B,129C 'mani':62B,132C 'nativ':39B,103C 'node.js':21B,74B,157C 'npm':22B 'number':140C 'ordinari':170C 'packag':23B 'percent':53B,113C 'percent-encod':52B,112C 'perform':117C 'practic':176C 'prior':92C 'provid':85C 'quadrat':8A,69B,151C 'reach':165C 'reduc':174C 'regex':47B 'regular':123C 'regular-express':122C 'replac':48B,125C,142C 'request':161C 'request-bodi':160C 'robust':88C 'run':42B,55B,64B,115C,134C 'scan':145C 'self':25B 'self-host':24B 'servic':80B 'size':168C 'string':46B,121C 'therefor':136C 'throw':41B,105C 'togeth':149C 'uri':3A,32B,83C 'url':171C 'use':10A,37B 'version':183C 'web':28B 'web-api':27B 'work':67B","nicknames":[],"mitigations":[],"who_affected":"Node.js services that decode untrusted percent-encoded input with this package, directly or through a dependency that uses it, are exposed. Request bodies can reach the size needed for a noticeable delay, while typical URL header limits reduce the practical impact. Projects that do not install this package, or only run it on trusted input, can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-28T21:16:56+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"security-advisories@github.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-118664","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-118664","severity":null,"published_at":"2026-10-28T21:16:56+00:00","modified_at":"2026-10-28T21:16:56+00:00","first_seen_at":"2026-10-28T21:35:45+00:00","fetched_at":"2026-10-28T21:35:45+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}