CVE-2026-45822
decode-uri-component: Denial of service via exponential decoding of malformed percent-encoded input
decode-uri-component through 0.4.1 is vulnerable to denial of service. The decode() function splits input on '%' producing N tokens and calls decodeComponents(), exhibiting super-linear parsing time: 200 '%ab' tokens takes approximately 0.7s, 700 tokens approximately 6s, and 1400 tokens approximately 33s. An attacker can cause significant CPU consumption and event-loop blocking via crafted input.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- None
- Availability
- High
Exploit likelihood
What each source reports
CVE List Score used
decode-uri-component through 0.4.1 is vulnerable to denial of service. The decode() function splits input on '%' producing N tokens and calls decodeComponents(), exhibiting super-linear parsing time: 200 '%ab' tokens takes approximately 0.7s, 700 tokens approximately 6s, and 1400 tokens approximately 33s. An attacker can cause significant CPU consumption and event-loop blocking via crafted input.
- Record
CVE-2026-45822- CVSS 4.0
- 6.6 Medium
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/S:N/AU:Y/R:U/V:D/RE:M/U:Amber - Weakness
- CWE-400, CWE-407
- Updated
- 2026-11-02
EUVDEUVD-2026-40267
decode-uri-component through 0.4.1 is vulnerable to denial of service. The decode() function splits input on '%' producing N tokens and calls decodeComponents(), exhibiting super-linear parsing time: 200 '%ab' tokens takes approximately 0.7s, 700 tokens approximately 6s, and 1400 tokens approximately 33s. An attacker can cause significant CPU consumption and event-loop blocking via crafted input.
- Record
EUVD-2026-40267- CVSS 4.0
- 6.6 Medium
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/S:N/AU:Y/R:U/V:D/RE:M/U:Amber - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-vcc3-ghjq-m6fr
decode-uri-component: Denial of service via exponential decoding of malformed percent-encoded input
Impact
An attacker who can supply input to decodeUriComponent() (directly or via a dependency that uses this package on URL/query/path data) can cause excessive CPU usage and application unresponsiveness. This is an availability issue; there is no known memory corruption, data disclosure, or remote code execution impact.
Patches
Upgrade to [email protected].
Workarounds
Limit the size of the input.
- Record
GHSA-vcc3-ghjq-m6fr- CVSS 4.0
- 6.6 Medium
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/S:N/AU:Y/R:U/V:D/RE:M/U:Amber - Weakness
- CWE-400, CWE-405, CWE-407, CWE-1176
- Updated
- 2026-11-02
NVD
decode-uri-component through 0.4.1 is vulnerable to denial of service. The decode() function splits input on '%' producing N tokens and calls decodeComponents(), exhibiting super-linear parsing time: 200 '%ab' tokens takes approximately 0.7s, 700 tokens approximately 6s, and 1400 tokens approximately 33s. An attacker can cause significant CPU consumption and event-loop blocking via crafted input.
- Record
CVE-2026-45822- CVSS 4.0
- 6.6 Medium
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:N/AU:Y/R:U/V:D/RE:M/U:Amber - Weakness
- CWE-400, CWE-407
- Updated
- 2026-11-02
OSV
decode-uri-component through 0.4.1 is vulnerable to denial of service. The decode() function splits input on '%' producing N tokens and calls decodeComponents(), exhibiting super-linear parsing time: 200 '%ab' tokens takes approximately 0.7s, 700 tokens approximately 6s, and 1400 tokens approximately 33s. An attacker can cause significant CPU consumption and event-loop blocking via crafted input.
- Record
CVE-2026-45822- CVSS 4.0
- 6.6 Medium
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/S:N/AU:Y/R:U/V:D/RE:M/U:Amber - Weakness
- CWE-400, CWE-407
- Updated
- 2026-11-02
OSVGHSA-vcc3-ghjq-m6fr
decode-uri-component: Denial of service via exponential decoding of malformed percent-encoded input
Impact
An attacker who can supply input to decodeUriComponent() (directly or via a dependency that uses this package on URL/query/path data) can cause excessive CPU usage and application unresponsiveness. This is an availability issue; there is no known memory corruption, data disclosure, or remote code execution impact.
Patches
Upgrade to [email protected].
Workarounds
Limit the size of the input.
- Record
GHSA-vcc3-ghjq-m6fr- CVSS 4.0
- 6.6 Medium
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/S:N/AU:Y/R:U/V:D/RE:M/U:Amber - Weakness
- CWE-1176, CWE-400, CWE-405, CWE-407
- Updated
- 2026-11-02
OSVUBUNTU-CVE-2026-45822
decode-uri-component through 0.4.1 is vulnerable to denial of service. The decode() function splits input on '%' producing N tokens and calls decodeComponents(), exhibiting super-linear parsing time: 200 '%ab' tokens takes approximately 0.7s, 700 tokens approximately 6s, and 1400 tokens approximately 33s. An attacker can cause significant CPU consumption and event-loop blocking via crafted input.
- Record
UBUNTU-CVE-2026-45822- CVSS 4.0
- 6.6 Medium
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/S:N/AU:Y/R:U/V:D/RE:M/U:Amber - Updated
- 2026-11-02
OSVAZL-92075 No score
CVE-2026-45822 affecting package js-jquery 3.5.0-4
decode-uri-component through 0.4.1 is vulnerable to denial of service. The decode() function splits input on '%' producing N tokens and calls decodeComponents(), exhibiting super-linear parsing time: 200 '%ab' tokens takes approximately 0.7s, 700 tokens approximately 6s, and 1400 tokens approximately 33s. An attacker can cause significant CPU consumption and event-loop blocking via crafted input.
- Record
AZL-92075- Updated
- 2026-11-05
OSVCLSA-2026-1788255041 No score
TuxCare security update for decode-uri-component (1 CVE)
TuxCare rebuilt decode-uri-component to address 1 CVE. Fixed in 0.2.2-tuxcare.1.
- Record
CLSA-2026-1788255041- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
decode-uri-componentnpm |
through 0.4.2 | 0.5.0 |
js-jqueryAzure Linux:3 |
through 3.5.0-4 | None known |
decode-uri-componentTuxCare:npm |
0.2.2-tuxcare.0 up to 0.2.2-tuxcare.1, plus listed versions 0.2.2 |
0.2.2-tuxcare.1 |
decode-uri-componentnpm |
before 0.5.0 | 0.5.0 |
node-source-map-resolveUbuntu:22.04:LTS |
All versions, plus listed versions 0.6.0+~cs2.7.2-20.6.0+~cs2.7.3-2 |
None known |
node-source-map-resolveUbuntu:24.04:LTS |
All versions, plus listed versions 0.6.0+~cs2.7.3-2 |
None known |
node-source-map-resolveUbuntu:25.10 |
All versions, plus listed versions 0.6.0+~cs2.7.3-2 |
None known |
node-source-map-resolveUbuntu:26.10 |
All versions, plus listed versions 0.6.0+~cs2.7.3-2 |
None known |
node-source-map-resolveUbuntu:26.04:LTS |
All versions, plus listed versions 0.6.0+~cs2.7.3-2 |
None known |
History
| Recorded | Changed | Sources |
|---|---|---|
| facts | OSV | |
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2026-45822 is a medium vulnerability (CVSS 6.6) in Samverschueren Decode-uri-component, published June 30, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.51%, the 43rd percentile. Fixed in decode-uri-component 0.5.0.
References
github.com/SamVerschueren/decode-uri-component/blob/00662938dc7c6241547ae8abce7785cc13ffd3f6/index.js
npmjs.com/package/decode-uri-component
nvd.nist.gov/vuln/detail/CVE-2026-45822