67 matches found
CVE-2026-118664
A flaw was found in decode-uri-component. A remote attacker can trigger a Denial of Service DoS by sending crafted input containing numerous malformed percent-encoded sequences. When processing this input, an inefficient fallback decoding routine consumes excessive processor resources and blocks...
GHSA-QR28-FPJM-WQ7F decode-uri-component vulnerable to denial of service via quadratic replacement of percent-encoded runs
Summary decodeUriComponent takes quadratic time on malformed input that has many distinct percent-encoded runs. A single unauthenticated request of about 224 KB can block the Node.js event loop for about 20 seconds. Version 0.5.0, the release that fixed CVE-2026-45822, is affected. Details When...
decode-uri-component vulnerable to denial of service via quadratic replacement of percent-encoded runs
Summary decodeUriComponent takes quadratic time on malformed input that has many distinct percent-encoded runs. A single unauthenticated request of about 224 KB can block the Node.js event loop for about 20 seconds. Version 0.5.0, the release that fixed CVE-2026-45822, is affected. Details When...
EUVD-2026-112471
decode-uri-component vulnerable to denial of service via quadratic replacement of percent-encoded runs...
npm: decode-uri-component vulnerable to denial of service via quadratic replacement of percent-encoded runs
npm: decode-uri-component vulnerable to denial of service via quadratic replacement of percent-encoded runs vulnerability discovered by ? in WordPress npm decode-uri-component versions = 0.5.0...
CVE-2026-118664
decode-uri-component provides a more robust alternative to decodeURIComponent. Prior to 0.5.1, decodeUriComponent in index.js falls back to customDecodeURIComponent after native decoding throws, and the fallback collects every distinct percent-encoded run before performing a full-string...
CVE-2026-118664
The decode-uri-component library (prior to version 0.5.1 ) is vulnerable to a Denial of Service (DoS) attack. The issue resides in the decodeUriComponent function within index.js, where a fallback mechanism (customDecodeURIComponent) handles malformed input by collecting distinct percent-encoded ...
CVE-2026-118664 decode-uri-component: Denial of service via quadratic replacement of percent-encoded runs
decode-uri-component provides a more robust alternative to decodeURIComponent. Prior to 0.5.1, decodeUriComponent in index.js falls back to customDecodeURIComponent after native decoding throws, and the fallback collects every distinct percent-encoded run before performing a full-string...
CVE-2026-118664
decode-uri-component provides a more robust alternative to decodeURIComponent. Prior to 0.5.1, decodeUriComponent in index.js falls back to customDecodeURIComponent after native decoding throws, and the fallback collects every distinct percent-encoded run before performing a full-string...
CVE-2026-118664 decode-uri-component: Denial of service via quadratic replacement of percent-encoded runs
decode-uri-component provides a more robust alternative to decodeURIComponent. Prior to 0.5.1, decodeUriComponent in index.js falls back to customDecodeURIComponent after native decoding throws, and the fallback collects every distinct percent-encoded run before performing a full-string...
CVE-2026-118664 decode-uri-component: Denial of service via quadratic replacement of percent-encoded runs
decode-uri-component provides a more robust alternative to decodeURIComponent. Prior to 0.5.1, decodeUriComponent in index.js falls back to customDecodeURIComponent after native decoding throws, and the fallback collects every distinct percent-encoded run before performing a full-string...
CVE-2026-118664: SamVerschueren decode-uri-component: decode-uri-component provides a more robust alternative to decodeURIComponent
decode-uri-component provides a more robust alternative to decodeURIComponent. Prior to 0.5.1, decodeUriComponent in index.js falls back to customDecodeURIComponent after native decoding throws, and the fallback collects every distinct percent-encoded run before performing a full-string...
PT-2026-129185
Name of the Vulnerable Software and Affected Versions decode-uri-component versions prior to 0.5.1 Description The decodeUriComponent function in index.js uses a fallback mechanism called customDecodeURIComponent when native decoding fails. This fallback process identifies every distinct...
AlmaLinux 9.2 [TuxCare] Security Update: pcs / pcs-snmp Multiple Vulnerabilities (ALMALINUX9.2:CLSA-2026:1792125039)
The AlmaLinux 9.2 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1792125039 advisory. - decode-uri-component 0.2.0 is vulnerable to Improper Input Validation resulting in DoS. CVE-2022-38900 - Rack is a modular Ruby we...
CentOS Linux 8.4 [TuxCare] Security Update: pcs / pcs-snmp Multiple Vulnerabilities (CENTOS8.4:CLSA-2026:1790610952)
The CentOS Linux 8.4 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare CENTOS8.4:CLSA-2026:1790610952 advisory. - A flaw was found in the Pacemaker configuration tool pcs. The pcs daemon was allowing expired accounts, and accounts with expired...
CentOS Linux 8.5 [TuxCare] Security Update: pcs / pcs-snmp Multiple Vulnerabilities (CENTOS8.5:CLSA-2026:1790611274)
The CentOS Linux 8.5 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare CENTOS8.5:CLSA-2026:1790611274 advisory. - A flaw was found in the Pacemaker configuration tool pcs. The pcs daemon was allowing expired accounts, and accounts with expired...
CLSA-2026-1790611274 pcs: Fix of 7 CVEs
CVE-2022-1049: fix pcsd PAM auth accepting expired accounts and passwords - CVE-2022-38900: fix DoS in decode of bundled decode-uri-component - CVE-2022-45442: fix reflected file download in bundled sinatra attachment - CVE-2023-27530: fix multipart part count DoS in rack via rack 2.2.20 -...
CLSA-2026-1790610952 pcs: Fix of 7 CVEs
CVE-2022-1049: fix pcsd PAM auth accepting expired accounts and passwords - CVE-2022-38900: fix DoS in decode of bundled decode-uri-component - CVE-2022-45442: fix reflected file download in bundled sinatra attachment - CVE-2023-27530: fix multipart part count DoS in rack via rack 2.2.20 -...