CVE-2026-45822: decode-uri-component: Denial of service via exponential decoding of malformed percent-encoded input

Severity: medium (CVSS 6.6 v4.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.5% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-06-30 · updated 2026-10-25
Weakness: CWE-400

Description

decode-uri-component through 0.4.1 is vulnerable to denial of service. The decode() function splits input on '%' producing N tokens and calls decodeComponents(), exhibiting super-linear parsing time: 200 '%ab' tokens takes approximately 0.7s, 700 tokens approximately 6s, and 1400 tokens approximately 33s. An attacker can cause significant CPU consumption and event-loop blocking via crafted input.

Affected products

Npm Decode-Uri-Component: before 0.5.0 — fixed in 0.5.0
SamVerschueren decode-uri-component: from 0.1.0 before 0.5.0 — fixed in 0.5.0

How to fix

Upgrade to a fixed version: Npm Decode-Uri-Component 0.5.0; SamVerschueren decode-uri-component 0.5.0. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2026-45822 or the next vulnerability affects your stack