---
id: "CVE-2026-118664"
kind: "vulnerability"
aliases: ["CVE-2026-118664"]
title: "decode-uri-component: crafted input causes quadratic CPU use and event loop blocking"
severity: "high"
cvss: 8.2
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["node.js", "npm", "package", "self-hosted", "web-api"]
not_affected_if: ["not-installed", "trusted-input-only"]
published_at: "2026-10-28T21:16:56+00:00"
first_seen_at: "2026-10-28T21:35:45+00:00"
updated_at: "2026-10-28T21:36:36+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-118664", "first_seen_at": "2026-10-28T21:35:45+00:00"}]
---

# decode-uri-component: crafted input causes quadratic CPU use and event loop blocking

decode-uri-component's fallback decoder, used when native decoding throws, runs a full-string regex replacement for every distinct percent-encoded run in the input. Malformed input with many distinct runs makes CPU work grow quadratically and can block the Node.js event loop, a denial of service.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Run `npm ls decode-uri-component` in each project to find the installed version.
- Check lockfiles (`package-lock.json`, `yarn.lock`, `pnpm-lock.yaml`) for `decode-uri-component` versions below `0.5.1`.

## Fix

- Upgrade `decode-uri-component` to `0.5.1` or later, including transitive copies that libraries pull in.
- Rebuild and redeploy after the upgrade, then confirm with `npm ls decode-uri-component`.

## Timeline

- 2026-10-28T21:35:45+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-118664

## From the sources

decode-uri-component provides a more robust alternative to decodeURIComponent. Prior to 0.5.1, decodeUriComponent in index.js falls back to customDecodeURIComponent after native decoding throws, and the fallback collects every distinct percent-encoded run before performing a full-string regular-expression replacement for each entry. Malformed input containing many distinct runs can therefore make both the number of replacements and the scanned input length grow together, causing quadratic CPU consumption and blocking the Node.js event loop; request-body inputs can reach the demonstrated size, while ordinary URL header limits reduce the practical delay. This issue is fixed in version 0.5.1.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_