3vulnerabilities
- Critical0 (0.0%)
- High2 (66.7%)
- Medium0 (0.0%)
- Moderate1 (33.3%)
- Low0 (0.0%)
decode-uri-component
Ecosystem: npm
Downloads:
- 0CriticalAffects 0 versions
- 2HighAffects 2 versions
- 0MediumAffects 0 versions
- 1ModerateAffects 1 version
- 0LowAffects 0 versions
Monthly breakdown
- Critical
- High
- Medium
- Moderate
- Low
- 1 vulnerabilities
- Critical: 0
- High: 1
- Medium: 0
- Moderate: 0
- Low: 0
- 1 vulnerabilities
- Critical: 0
- High: 0
- Medium: 0
- Moderate: 1
- Low: 0
- 1 vulnerabilities
- Critical: 0
- High: 1
- Medium: 0
- Moderate: 0
- Low: 0
Vulnerabilities (3)
Known vulnerabilities affecting decode-uri-component, based on data from OSV.
| ID | Severity | Summary | Affected versions | Published | Source |
|---|---|---|---|---|---|
| GHSA-qr28-fpjm-wq7f | High | decode-uri-component vulnerable to denial of service via quadratic replacement of percent-encoded runs### Summary `decodeUriComponent()` takes quadratic time on malformed input that has many distinct percent-encoded runs. A single unauthenticated request of about 224 KB can block the Node.js event loop for about 20 seconds. Version 0.5.0, the release that fixed CVE-2026-45822, is affected. ### Details When native decodeURIComponent throws, `decodeUriComponent()` falls back to `customDecodeURIComponent` (`index.js:122`). That function: 1. Scans the input for every run of percent-encoded bytes (e.g. `%C3%A5`) and stores each distinct run, with its decoded value, in a lookup table (`index.js:1 |
| GitHub (opens in a new tab) | |
| GHSA-vcc3-ghjq-m6fr | Moderate | decode-uri-component: Denial of service via exponential decoding of malformed percent-encoded input### Impact An attacker who can supply input to `decodeUriComponent()` (directly or via a dependency that uses this package on URL/query/path data) can cause excessive CPU usage and application unresponsiveness. This is an availability issue; there is no known memory corruption, data disclosure, or remote code execution impact. ### Patches Upgrade to `decode-uri-component@0.5.0`. ### Workarounds Limit the size of the input. |
| GitHub (opens in a new tab) | |
| GHSA-w573-4hg7-7wgq | High | decode-uri-component vulnerable to Denial of Service (DoS)decode-uri-component 0.2.0 is vulnerable to Improper Input Validation resulting in DoS. |
| GitHub (opens in a new tab) |
- GHSA-qr28-fpjm-wq7fHighdecode-uri-component vulnerable to denial of service via quadratic replacement of percent-encoded runs
< 0.5.1
### Summary `decodeUriComponent()` takes quadratic time on malformed input that has many distinct percent-encoded runs. A single unauthenticated request of about 224 KB can block the Node.js event loop for about 20 seconds. Version 0.5.0, the release that fixed CVE-2026-45822, is affected. ### Details When native decodeURIComponent throws, `decodeUriComponent()` falls back to `customDecodeURIComponent` (`index.js:122`). That function: 1. Scans the input for every run of percent-encoded bytes (e.g. `%C3%A5`) and stores each distinct run, with its decoded value, in a lookup table (`index.js:1
CVE: CVE-2026-118664
- GHSA-vcc3-ghjq-m6frModeratedecode-uri-component: Denial of service via exponential decoding of malformed percent-encoded input
< 0.5.0
### Impact An attacker who can supply input to `decodeUriComponent()` (directly or via a dependency that uses this package on URL/query/path data) can cause excessive CPU usage and application unresponsiveness. This is an availability issue; there is no known memory corruption, data disclosure, or remote code execution impact. ### Patches Upgrade to `decode-uri-component@0.5.0`. ### Workarounds Limit the size of the input.
CVE: CVE-2026-45822
- GHSA-w573-4hg7-7wgqHighdecode-uri-component vulnerable to Denial of Service (DoS)
< 0.2.1
decode-uri-component 0.2.0 is vulnerable to Improper Input Validation resulting in DoS.
CVE: CVE-2022-38900