ROOT-APP-NPM-CVE-2026-118664 CVE-2026-118664 in decode-uri-component - Patched by Root

Root has patched CVE-2026-118664 in the decode-uri-component package for Root:npm. Multiple fixed versions available...

decode-uri-component decoder DoS

The vulnerability in the decodeUriComponent function of the decode-uri-component decoder is related to uncontrolled resource consumption. Exploitation of this vulnerability may allow a remote attacker to cause a denial of service...

CVE-2026-118664

A flaw was found in decode-uri-component. A remote attacker can trigger a Denial of Service DoS by sending crafted input containing numerous malformed percent-encoded sequences. When processing this input, an inefficient fallback decoding routine consumes excessive processor resources and blocks...

SUSE CVE-2026-118664

decode-uri-component provides a more robust alternative to decodeURIComponent. Prior to 0.5.1, decodeUriComponent in index.js falls back to customDecodeURIComponent after native decoding throws, and the fallback collects every distinct percent-encoded run before performing a full-string...

npm: decode-uri-component vulnerable to denial of service via quadratic replacement of percent-encoded runs

npm: decode-uri-component vulnerable to denial of service via quadratic replacement of percent-encoded runs vulnerability discovered by ? in WordPress npm decode-uri-component versions = 0.5.0...

GHSA-QR28-FPJM-WQ7F decode-uri-component vulnerable to denial of service via quadratic replacement of percent-encoded runs

Summary decodeUriComponent takes quadratic time on malformed input that has many distinct percent-encoded runs. A single unauthenticated request of about 224 KB can block the Node.js event loop for about 20 seconds. Version 0.5.0, the release that fixed CVE-2026-45822, is affected. Details When...

decode-uri-component vulnerable to denial of service via quadratic replacement of percent-encoded runs

Summary decodeUriComponent takes quadratic time on malformed input that has many distinct percent-encoded runs. A single unauthenticated request of about 224 KB can block the Node.js event loop for about 20 seconds. Version 0.5.0, the release that fixed CVE-2026-45822, is affected. Details When...

EUVD-2026-112471

decode-uri-component vulnerable to denial of service via quadratic replacement of percent-encoded runs...

Regular Expression Denial of Service (ReDoS)

Overview Affected versions of this package are vulnerable to Regular Expression Denial of Service ReDoS via the customDecodeURIComponent function, which uses a quadratic replacement loop over percent-encoded runs. An attacker can supply a large input string containing many distinct percent-encode...

CVE-2026-118664

decode-uri-component provides a more robust alternative to decodeURIComponent. Prior to 0.5.1, decodeUriComponent in index.js falls back to customDecodeURIComponent after native decoding throws, and the fallback collects every distinct percent-encoded run before performing a full-string...

CVE-2026-118664

decode-uri-component provides a more robust alternative to decodeURIComponent. Prior to 0.5.1, decodeUriComponent in index.js falls back to customDecodeURIComponent after native decoding throws, and the fallback collects every distinct percent-encoded run before performing a full-string...

CVE-2026-118664 decode-uri-component: Denial of service via quadratic replacement of percent-encoded runs

decode-uri-component provides a more robust alternative to decodeURIComponent. Prior to 0.5.1, decodeUriComponent in index.js falls back to customDecodeURIComponent after native decoding throws, and the fallback collects every distinct percent-encoded run before performing a full-string...

CVE-2026-118664 decode-uri-component: Denial of service via quadratic replacement of percent-encoded runs

decode-uri-component provides a more robust alternative to decodeURIComponent. Prior to 0.5.1, decodeUriComponent in index.js falls back to customDecodeURIComponent after native decoding throws, and the fallback collects every distinct percent-encoded run before performing a full-string...

CVE-2026-118664 decode-uri-component: Denial of service via quadratic replacement of percent-encoded runs

decode-uri-component provides a more robust alternative to decodeURIComponent. Prior to 0.5.1, decodeUriComponent in index.js falls back to customDecodeURIComponent after native decoding throws, and the fallback collects every distinct percent-encoded run before performing a full-string...

CVE-2026-118664

The decode-uri-component library (prior to version 0.5.1 ) is vulnerable to a Denial of Service (DoS) attack. The issue resides in the decodeUriComponent function within index.js, where a fallback mechanism (customDecodeURIComponent) handles malformed input by collecting distinct percent-encoded ...

PT-2026-129185

Name of the Vulnerable Software and Affected Versions decode-uri-component versions prior to 0.5.1 Description The decodeUriComponent function in index.js uses a fallback mechanism called customDecodeURIComponent when native decoding fails. This fallback process identifies every distinct...

Sam Verschueren decode-uri-component resource management error vulnerability

Versions of Sam Verschueren’s decode-uri-component prior to 0.5.1 contain a resource management error vulnerability. This vulnerability arises because when decodeUriComponent fails to perform native decoding and reverts to customDecodeURIComponent, it performs a full string regular expression...

CVE-2026-118664: Uncontrolled Resource Consumption

decode-uri-component provides a more robust alternative to decodeURIComponent. Prior to 0.5.1, decodeUriComponent in index.js falls back to customDecodeURIComponent after native decoding throws, and the fallback collects every distinct percent-encoded run before performing a full-string...

PT-2026-135880

Уязвимость функции decodeUriComponent декодера URI компонентов decode-uri-component связана с неконтролируемым расходом ресурсов. Эксплуатация уязвимости может позволить нарушителю, действующему удаленно, вызвать отказ в обслуживании...

AlmaLinux 9.2 [TuxCare] Security Update: pcs / pcs-snmp Multiple Vulnerabilities (ALMALINUX9.2:CLSA-2026:1792125039)

The AlmaLinux 9.2 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1792125039 advisory. - decode-uri-component 0.2.0 is vulnerable to Improper Input Validation resulting in DoS. CVE-2022-38900 - Rack is a modular Ruby we...