Skip to content
CVE PROGRAM SOURCE RECORD6.6 Medium

CVE-2026-45822

decode-uri-component through 0.4.1 is vulnerable to denial of service. The decode() function splits input on '%' producing N tokens and calls decodeComponents(), exhibiting super-l

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
seal

Description

decode-uri-component through 0.4.1 is vulnerable to denial of service. The decode() function splits input on '%' producing N tokens and calls decodeComponents(), exhibiting super-linear parsing time: 200 '%ab' tokens takes approximately 0.7s, 700 tokens approximately 6s, and 1400 tokens approximately 33s. An attacker can cause significant CPU consumption and event-loop blocking via crafted input.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

SamVerschueren decode-uri-component

Default version status: unaffected

  • 0.1.0 to < 0.5.0affected

References