{"id":"CVE-2022-38900","aliases":["ALSA-2023:1743","ALSA-2023:6316","AZL-44976","CLSA-2026-1780620683","CLSA-2026-1790610952","CLSA-2026-1790611274","EUVD-2022-7447","GHSA-w573-4hg7-7wgq","RHSA-2023:1533","RHSA-2023:1742","RHSA-2023:1743","RHSA-2023:1744","RHSA-2023:6316","RLSA-2023:1743","ROOT-APP-NPM-CVE-2022-38900"],"status":"published","title":"decode-uri-component vulnerable to Denial of Service (DoS)","description":"decode-uri-component 0.2.0 is vulnerable to Improper Input Validation resulting in DoS.","severity":{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-10","score":0.22539,"percentile":0.97725,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-20"],"published":"2022-11-28T00:00:00Z","modified":"2026-11-05T05:36:30Z","fixes":[{"ecosystem":"npm","package":"decode-uri-component","fixed_in":["0.2.1"],"sources":["ghsa","osv"]},{"ecosystem":"AlmaLinux:9","package":"pcs","fixed_in":["0.11.6-3.el9"],"sources":["osv"]},{"ecosystem":"AlmaLinux:9","package":"pcs-snmp","fixed_in":["0.11.6-3.el9"],"sources":["osv"]},{"ecosystem":"TuxCare:npm","package":"decode-uri-component","fixed_in":["0.2.0-tuxcare.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::highavailability","package":"pcs","fixed_in":["0:0.11.6-3.el9"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::highavailability","package":"pcs-snmp","fixed_in":["0:0.11.6-3.el9"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::resilientstorage","package":"pcs","fixed_in":["0:0.11.6-3.el9"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::resilientstorage","package":"pcs-snmp","fixed_in":["0:0.11.6-3.el9"],"sources":["osv"]},{"ecosystem":"Root:npm","package":"@rootio/decode-uri-component","fixed_in":["0.2.0-root.io.1","0.2.0-root.io.2"],"sources":["osv"]},{"ecosystem":"Root:npm","package":"decode-uri-component","fixed_in":["0.2.0-aikido.2"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"npm","package":"decode-uri-component","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.2.1"}]}]},{"source":"osv","ecosystem":"AlmaLinux:8","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:14.21.3-1.module_el8.7.0+3551+53700ee8"}]}],"bundled":7},{"source":"osv","ecosystem":"AlmaLinux:8","package":"nodejs-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:14.21.3-1.module_el8.7.0+3551+53700ee8"}]}],"bundled":7},{"source":"osv","ecosystem":"AlmaLinux:8","package":"nodejs-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:14.21.3-1.module_el8.7.0+3551+53700ee8"}]}],"bundled":7},{"source":"osv","ecosystem":"AlmaLinux:8","package":"nodejs-full-i18n","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:14.21.3-1.module_el8.7.0+3551+53700ee8"}]}],"bundled":7},{"source":"osv","ecosystem":"AlmaLinux:8","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.20-3.module_el8.7.0+3551+53700ee8"}]}],"bundled":7},{"source":"osv","ecosystem":"AlmaLinux:8","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"23-3.module_el8.4.0+2522+3bd42762"}]}],"bundled":7},{"source":"osv","ecosystem":"AlmaLinux:8","package":"npm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:6.14.18-1.14.21.3.1.module_el8.7.0+3551+53700ee8"}]}],"bundled":7},{"source":"osv","ecosystem":"AlmaLinux:9","package":"pcs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.11.6-3.el9"}]}]},{"source":"osv","ecosystem":"AlmaLinux:9","package":"pcs-snmp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.11.6-3.el9"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"js-jquery","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"3.5.0-4"}]}]},{"source":"osv","ecosystem":"TuxCare:npm","package":"decode-uri-component","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.2.0-tuxcare.0"},{"fixed":"0.2.0-tuxcare.1"}]}],"versions":["0.2.0"]},{"source":"osv","ecosystem":"TuxCare:CentOS:8.4","package":"pcs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.10.8-1.el8.tuxcare.els2"}]}],"bundled":7},{"source":"osv","ecosystem":"TuxCare:CentOS:8.4","package":"pcs-snmp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.10.8-1.el8.tuxcare.els2"}]}],"bundled":7},{"source":"osv","ecosystem":"TuxCare:CentOS:8.5","package":"pcs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.10.8-1.el8.tuxcare.els2"}]}],"bundled":7},{"source":"osv","ecosystem":"TuxCare:CentOS:8.5","package":"pcs-snmp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.10.8-1.el8.tuxcare.els2"}]}],"bundled":7},{"source":"osv","ecosystem":"npm","package":"decode-uri-component","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"0.2.1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.4::appstream","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:14.21.3-1.module+el8.4.0+18317+43f5ac16"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.4::appstream","package":"nodejs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:14.21.3-1.module+el8.4.0+18317+43f5ac16"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.4::appstream","package":"nodejs-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:14.21.3-1.module+el8.4.0+18317+43f5ac16"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.4::appstream","package":"nodejs-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:14.21.3-1.module+el8.4.0+18317+43f5ac16"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.4::appstream","package":"nodejs-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:14.21.3-1.module+el8.4.0+18317+43f5ac16"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.4::appstream","package":"nodejs-full-i18n","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:14.21.3-1.module+el8.4.0+18317+43f5ac16"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.4::appstream","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.20-3.module+el8.4.0+18317+43f5ac16"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.4::appstream","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:23-3.module+el8.3.0+6519+9f98ed83"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.4::appstream","package":"npm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:6.14.18-1.14.21.3.1.module+el8.4.0+18317+43f5ac16"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.6::appstream","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:14.21.3-1.module+el8.6.0+18532+cbe6f646"}]}],"bundled":16},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.6::appstream","package":"nodejs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:14.21.3-1.module+el8.6.0+18532+cbe6f646"}]}],"bundled":16},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.6::appstream","package":"nodejs-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:14.21.3-1.module+el8.6.0+18532+cbe6f646"}]}],"bundled":16},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.6::appstream","package":"nodejs-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:14.21.3-1.module+el8.6.0+18532+cbe6f646"}]}],"bundled":16},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.6::appstream","package":"nodejs-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:14.21.3-1.module+el8.6.0+18532+cbe6f646"}]}],"bundled":16},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.6::appstream","package":"nodejs-full-i18n","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:14.21.3-1.module+el8.6.0+18532+cbe6f646"}]}],"bundled":16},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.6::appstream","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.20-3.module+el8.6.0+18532+cbe6f646"}]}],"bundled":16},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.6::appstream","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:23-3.module+el8.3.0+6519+9f98ed83"}]}],"bundled":16},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.6::appstream","package":"npm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:6.14.18-1.14.21.3.1.module+el8.6.0+18532+cbe6f646"}]}],"bundled":16},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:14.21.3-1.module+el8.7.0+18531+81d21ca6"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:14.21.3-1.module+el8.7.0+18531+81d21ca6"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:14.21.3-1.module+el8.7.0+18531+81d21ca6"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:14.21.3-1.module+el8.7.0+18531+81d21ca6"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:14.21.3-1.module+el8.7.0+18531+81d21ca6"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-full-i18n","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:14.21.3-1.module+el8.7.0+18531+81d21ca6"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.20-3.module+el8.7.0+18531+81d21ca6"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:23-3.module+el8.3.0+6519+9f98ed83"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"npm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:6.14.18-1.14.21.3.1.module+el8.7.0+18531+81d21ca6"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el7","package":"rh-nodejs14","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.6-2.el7"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el7","package":"rh-nodejs14-nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:14.21.3-2.el7"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el7","package":"rh-nodejs14-nodejs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:14.21.3-2.el7"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el7","package":"rh-nodejs14-nodejs-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:14.21.3-2.el7"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el7","package":"rh-nodejs14-nodejs-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:14.21.3-2.el7"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el7","package":"rh-nodejs14-nodejs-full-i18n","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:14.21.3-2.el7"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el7","package":"rh-nodejs14-npm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.14.18-14.21.3.2.el7"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el7","package":"rh-nodejs14-runtime","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.6-2.el7"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el7","package":"rh-nodejs14-scldevel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.6-2.el7"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::highavailability","package":"pcs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.11.6-3.el9"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::highavailability","package":"pcs-snmp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.11.6-3.el9"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::resilientstorage","package":"pcs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.11.6-3.el9"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::resilientstorage","package":"pcs-snmp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.11.6-3.el9"}]}]},{"source":"osv","ecosystem":"Rocky Linux:8","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:14.21.3-1.module+el8.7.0+1183+c2c35f0a"}]}],"bundled":7},{"source":"osv","ecosystem":"Rocky Linux:8","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.20-3.module+el8.7.0+1178+d52dba78"}]}],"bundled":7},{"source":"osv","ecosystem":"Rocky Linux:8","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:23-3.module+el8.7.0+1071+4bdda2a8"}]}],"bundled":7},{"source":"osv","ecosystem":"Root:npm","package":"@rootio/decode-uri-component","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.2.0-root.io.1"},{"fixed":"0.2.0-root.io.2"}]}]},{"source":"osv","ecosystem":"Root:npm","package":"decode-uri-component","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.2.0-aikido.2"}]}]}],"products":[{"vendor":"decode-uri-component_project","product":"decode-uri-component"}],"references":[{"url":"https://github.com/SamVerschueren/decode-uri-component/issues/5","tags":["x_transferred","Exploit","Issue Tracking","Third Party Advisory","report","web","article"]},{"url":"https://github.com/sindresorhus/query-string/issues/345","tags":["x_transferred","Exploit","Issue Tracking","Third Party Advisory","report","web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KAC5KQ2SEWAMQ6UZAUBZ5KXKEOESH375/","tags":["vendor-advisory","x_transferred","advisory"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ERN6YE3DS7NBW7UH44SCJBMNC2NWQ7SM/","tags":["vendor-advisory","x_transferred","advisory"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VNV2GNZXOTEDAJRFH3ZYWRUBGIVL7BSU/","tags":["vendor-advisory","x_transferred","advisory"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QABOUA2I542UTANVZIVFKWMRYVHLV32D/","tags":["vendor-advisory","x_transferred","advisory"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UW4SCMT3SEUFVIL7YIADQ5K36GJEO6I5/","tags":["vendor-advisory","x_transferred","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-38900","tags":["web","advisory"]},{"url":"https://github.com/SamVerschueren/decode-uri-component/commit/746ca5dcb6667c5d364e782d53c542830e4c10b9","tags":["web"]},{"url":"https://github.com/SamVerschueren/decode-uri-component/releases/tag/v0.2.1","tags":["web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ERN6YE3DS7NBW7UH44SCJBMNC2NWQ7SM/"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/KAC5KQ2SEWAMQ6UZAUBZ5KXKEOESH375/"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/VNV2GNZXOTEDAJRFH3ZYWRUBGIVL7BSU/"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/QABOUA2I542UTANVZIVFKWMRYVHLV32D/"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UW4SCMT3SEUFVIL7YIADQ5K36GJEO6I5/"},{"url":"https://github.com/advisories/GHSA-w573-4hg7-7wgq","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2023:1743","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2021-35065","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2022-25881","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2022-3517","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2022-38900","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2022-4904","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2023-23918","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2023-23920","tags":["report"]},{"url":"https://bugzilla.redhat.com/2134609","tags":["report"]},{"url":"https://bugzilla.redhat.com/2156324","tags":["report"]},{"url":"https://bugzilla.redhat.com/2165824","tags":["report"]},{"url":"https://bugzilla.redhat.com/2168631","tags":["report"]},{"url":"https://bugzilla.redhat.com/2170644","tags":["report"]},{"url":"https://bugzilla.redhat.com/2171935","tags":["report"]},{"url":"https://bugzilla.redhat.com/2172217","tags":["report"]},{"url":"https://bugzilla.redhat.com/2175826","tags":["report"]},{"url":"https://errata.almalinux.org/8/ALSA-2023-1743.html","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2023:6316","tags":["advisory"]},{"url":"https://errata.almalinux.org/9/ALSA-2023-6316.html","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/centos8.4els/CLSA-2026-1790610952.html","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-1049","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-45442","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-27530","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-27539","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-52804","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-47287","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/centos8.5els/CLSA-2026-1790611274.html","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/38xxx/CVE-2022-38900.json","tags":["advisory"]},{"url":"https://github.com/SamVerschueren/decode-uri-component","tags":["package"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ERN6YE3DS7NBW7UH44SCJBMNC2NWQ7SM","tags":["web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/KAC5KQ2SEWAMQ6UZAUBZ5KXKEOESH375","tags":["web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/QABOUA2I542UTANVZIVFKWMRYVHLV32D","tags":["web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UW4SCMT3SEUFVIL7YIADQ5K36GJEO6I5","tags":["web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/VNV2GNZXOTEDAJRFH3ZYWRUBGIVL7BSU","tags":["web"]},{"url":"https://access.redhat.com/errata/RHSA-2023:1533","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#important","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2066009","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2130518","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2134609","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2140911","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2142823","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2150323","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2156324","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2165824","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2168631","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2170644","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2171935","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2172217","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2175828","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2023/rhsa-2023_1533.json","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-35065","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-35065","tags":["advisory"]},{"url":"https://security.snyk.io/vuln/SNYK-JS-GLOBPARENT-1314294","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2021-44906","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-44906","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-44906","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-xvch-5gv4-984h","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-3517","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-3517","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-4904","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-4904","tags":["advisory"]},{"url":"https://github.com/c-ares/c-ares/issues/496","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2022-24999","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-24999","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-24999","tags":["advisory"]},{"url":"https://github.com/expressjs/express/releases/tag/4.17.3","tags":["article"]},{"url":"https://github.com/ljharb/qs/pull/428","tags":["article"]},{"url":"https://github.com/n8tz/CVE-2022-24999","tags":["article"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-25881","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-25881","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2022-35256","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-35256","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-35256","tags":["advisory"]},{"url":"https://nodejs.org/en/blog/vulnerability/september-2022-security-releases/#http-request-smuggling-due-to-incorrect-parsing-of-header-fields-medium-cve-2022-35256","tags":["article"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-38900","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2022-43548","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-43548","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-43548","tags":["advisory"]},{"url":"https://nodejs.org/en/blog/vulnerability/november-2022-security-releases/#dns-rebinding-in-inspect-via-invalid-octal-ip-address-medium-cve-2022-43548","tags":["article"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-23918","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-23918","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-23920","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-23920","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2023:1742","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2040839","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2040846","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2040856","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2040862","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2044591","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2142822","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2175827","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2023/rhsa-2023_1742.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2021-44531","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-44531","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-44531","tags":["advisory"]},{"url":"https://nodejs.org/en/blog/vulnerability/jan-2022-security-releases/","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2021-44532","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-44532","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-44532","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2021-44533","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-44533","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-44533","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2022-0235","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-0235","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-0235","tags":["advisory"]},{"url":"https://huntr.dev/bounties/d26ab655-38d6-48b3-be15-f9ad6b6ae6f7/","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2022-21824","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-21824","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-21824","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2175826","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2023/rhsa-2023_1743.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2023:1744","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2153715","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2023/rhsa-2023_1744.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#low","tags":["article"]},{"url":"https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/9/html/9.3_release_notes/index","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1423473","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1465829","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2160664","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2163440","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2163914","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2163953","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2168155","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2168617","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2174735","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2175881","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2177996","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2178714","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2179388","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2182810","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2210855","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2216434","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2217850","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2219407","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2222788","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2023/rhsa-2023_6316.json","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2023:1743","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2022-38900","description":"decode-uri-component 0.2.0 is vulnerable to Improper Input Validation resulting in DoS.","status":"published","published":"2022-11-28T00:00:00Z","modified":"2025-04-25T19:50:41.971Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"adp"}],"cwes":["CWE-20"],"updated_at":"2026-11-02T14:34:37.272373Z"}],"euvd":[{"id":"EUVD-2022-7447","description":"decode-uri-component 0.2.0 is vulnerable to Improper Input Validation resulting in DoS.","status":"published","published":"2022-11-28T00:00:00Z","modified":"2025-04-25T19:50:41Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T20:52:02.538258Z"}],"ghsa":[{"id":"GHSA-w573-4hg7-7wgq","title":"decode-uri-component vulnerable to Denial of Service (DoS)","description":"decode-uri-component 0.2.0 is vulnerable to Improper Input Validation resulting in DoS.","status":"published","published":"2022-11-28T15:30:24Z","modified":"2023-09-21T22:16:39Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-20"],"updated_at":"2026-11-02T14:37:06.234371Z"}],"nvd":[{"id":"CVE-2022-38900","description":"decode-uri-component 0.2.0 is vulnerable to Improper Input Validation resulting in DoS.","status":"published","published":"2022-11-28T13:15:10.033Z","modified":"2026-06-17T04:57:18.207Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"primary"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"secondary"}],"cwes":["CWE-20"],"updated_at":"2026-11-02T14:07:32.827264Z"}],"osv":[{"id":"AZL-44976","title":"CVE-2022-38900 affecting package js-jquery 3.5.0-4","description":"decode-uri-component 0.2.0 is vulnerable to Improper Input Validation resulting in DoS.","status":"published","published":"2022-11-28T13:15:10Z","modified":"2026-11-05T05:36:30Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-05T16:41:20.321068Z"},{"id":"CVE-2022-38900","description":"decode-uri-component 0.2.0 is vulnerable to Improper Input Validation resulting in DoS.","status":"published","published":"2022-11-28T00:00:00Z","modified":"2026-10-28T02:30:31.515050388Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:44:26.53798Z"},{"id":"GHSA-w573-4hg7-7wgq","title":"decode-uri-component vulnerable to Denial of Service (DoS)","description":"decode-uri-component 0.2.0 is vulnerable to Improper Input Validation resulting in DoS.","status":"published","published":"2022-11-28T15:30:24Z","modified":"2023-11-08T04:10:14.135716Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-20"],"updated_at":"2026-11-02T15:46:58.04805Z"},{"id":"RHSA-2023:1533","title":"Red Hat Security Advisory: nodejs:14 security, bug fix, and enhancement update","status":"published","published":"2024-10-22T00:34:37Z","modified":"2026-10-13T10:04:00Z","cvss":[{"version":"3.1","score":8.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:10.611604Z"},{"id":"RHSA-2023:1742","title":"Red Hat Security Advisory: nodejs:14 security, bug fix, and enhancement update","status":"published","published":"2024-10-22T00:34:46Z","modified":"2026-10-16T10:02:02Z","cvss":[{"version":"3.1","score":8.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:10.611604Z"},{"id":"RHSA-2023:1743","title":"Red Hat Security Advisory: nodejs:14 security, bug fix, and enhancement update","status":"published","published":"2024-10-22T00:35:06Z","modified":"2026-10-13T10:04:02Z","cvss":[{"version":"3.1","score":8.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:10.611604Z"},{"id":"RHSA-2023:1744","title":"Red Hat Security Advisory: rh-nodejs14-nodejs security, bug fix, and enhancement update","status":"published","published":"2024-09-30T14:43:51Z","modified":"2026-10-13T10:04:03Z","cvss":[{"version":"3.1","score":8.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:10.611604Z"},{"id":"RHSA-2023:6316","title":"Red Hat Security Advisory: pcs security, bug fix, and enhancement update","status":"published","published":"2024-09-30T14:58:26Z","modified":"2026-10-13T10:05:23Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:11.734882Z"},{"id":"ALSA-2023:1743","title":"Important: nodejs:14 security, bug fix, and enhancement update","description":"Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language. \n\nThe following packages have been upgraded to a later upstream version: nodejs (14.21.3).\n\nSecurity Fix(es):\n\n* decode-uri-component: improper input validation resulting in DoS (CVE-2022-38900)\n* glob-parent: Regular Expression Denial of Service (CVE-2021-35065)\n* nodejs-minimatch: ReDoS via the braceExpand function (CVE-2022-3517)\n* c-ares: buffer overflow in config_sortlist() due to missing string length check (CVE-2022-4904)\n* http-cache-semantics: Regular Expression Denial of Service (ReDoS) vulnerability (CVE-2022-25881)\n* Node.js: Permissions policies can be bypassed via process.mainModule (CVE-2023-23918)\n* Node.js: insecure loading of ICU data through ICU_DATA environment variable (CVE-2023-23920)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2023-04-12T00:00:00Z","modified":"2026-10-29T11:01:36.448211693Z","updated_at":"2026-11-02T15:27:51.655726Z"},{"id":"ALSA-2023:6316","title":"Low: pcs security, bug fix, and enhancement update","description":"The pcs packages provide a command-line configuration system for the Pacemaker and Corosync utilities.\n\nSecurity Fix(es):\n\n* decode-uri-component: improper input validation resulting in DoS (CVE-2022-38900)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n\nAdditional Changes:\n\nFor detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.","status":"published","published":"2023-11-07T00:00:00Z","modified":"2026-10-29T11:31:31.490622337Z","updated_at":"2026-11-02T15:27:52.091404Z"},{"id":"CLSA-2026-1780620683","title":"TuxCare security update for decode-uri-component (1 CVE)","description":"TuxCare rebuilt decode-uri-component to address 1 CVE. Fixed in 0.2.0-tuxcare.1.","status":"published","published":"2026-08-04T14:52:35Z","modified":"2026-10-15T09:47:50.231448056Z","updated_at":"2026-11-02T15:43:45.445699Z"},{"id":"CLSA-2026-1790610952","title":"pcs: Fix of 7 CVEs","description":"- CVE-2022-1049: fix pcsd PAM auth accepting expired accounts and passwords\n- CVE-2022-38900: fix DoS in decode() of bundled decode-uri-component\n- CVE-2022-45442: fix reflected file download in bundled sinatra attachment()\n- CVE-2023-27530: fix multipart part count DoS in rack (via rack 2.2.20)\n- CVE-2023-27539: fix ReDoS in rack header parsing (via rack 2.2.20)\n- CVE-2024-52804: fix quadratic cookie parsing in bundled tornado\n- CVE-2025-47287: fix multipart parser log flooding DoS in bundled tornado","status":"published","published":"2026-09-28T15:56:09Z","modified":"2026-10-26T09:31:44.061169655Z","updated_at":"2026-11-02T15:43:48.65893Z"},{"id":"CLSA-2026-1790611274","title":"pcs: Fix of 7 CVEs","description":"- CVE-2022-1049: fix pcsd PAM auth accepting expired accounts and passwords\n- CVE-2022-38900: fix DoS in decode() of bundled decode-uri-component\n- CVE-2022-45442: fix reflected file download in bundled sinatra attachment()\n- CVE-2023-27530: fix multipart part count DoS in rack (via rack 2.2.20)\n- CVE-2023-27539: fix ReDoS in rack header parsing (via rack 2.2.20)\n- CVE-2024-52804: fix quadratic cookie parsing in bundled tornado\n- CVE-2025-47287: fix multipart parser log flooding DoS in bundled tornado","status":"published","published":"2026-09-28T16:01:31Z","modified":"2026-10-26T09:31:51.368414759Z","updated_at":"2026-11-02T15:43:48.65893Z"},{"id":"RLSA-2023:1743","title":"Important: nodejs:14 security, bug fix, and enhancement update","description":"Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language. \n\nThe following packages have been upgraded to a later upstream version: nodejs (14.21.3).\n\nSecurity Fix(es):\n\n* decode-uri-component: improper input validation resulting in DoS (CVE-2022-38900)\n\n* glob-parent: Regular Expression Denial of Service (CVE-2021-35065)\n\n* nodejs-minimatch: ReDoS via the braceExpand function (CVE-2022-3517)\n\n* c-ares: buffer overflow in config_sortlist() due to missing string length check (CVE-2022-4904)\n\n* http-cache-semantics: Regular Expression Denial of Service (ReDoS) vulnerability (CVE-2022-25881)\n\n* Node.js: Permissions policies can be bypassed via process.mainModule (CVE-2023-23918)\n\n* Node.js: insecure loading of ICU data through ICU_DATA environment variable (CVE-2023-23920)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2023-04-26T15:28:13.052501Z","modified":"2026-02-04T19:30:16.769935Z","updated_at":"2026-11-02T15:53:24.322216Z"},{"id":"ROOT-APP-NPM-CVE-2022-38900","title":"CVE-2022-38900 in @rootio/decode-uri-component - Patched by Root","description":"Root has patched CVE-2022-38900 in the @rootio/decode-uri-component package for Root:npm. Multiple fixed versions available.","status":"published","published":"2026-06-04T19:35:30Z","modified":"2026-06-05T01:30:07.367951177Z","updated_at":"2026-11-02T15:53:27.362922Z"}]}}