65 matches found
GHSA-QR28-FPJM-WQ7F decode-uri-component vulnerable to denial of service via quadratic replacement of percent-encoded runs
Summary decodeUriComponent takes quadratic time on malformed input that has many distinct percent-encoded runs. A single unauthenticated request of about 224 KB can block the Node.js event loop for about 20 seconds. Version 0.5.0, the release that fixed CVE-2026-45822, is affected. Details When...
decode-uri-component vulnerable to denial of service via quadratic replacement of percent-encoded runs
Summary decodeUriComponent takes quadratic time on malformed input that has many distinct percent-encoded runs. A single unauthenticated request of about 224 KB can block the Node.js event loop for about 20 seconds. Version 0.5.0, the release that fixed CVE-2026-45822, is affected. Details When...
npm: decode-uri-component vulnerable to denial of service via quadratic replacement of percent-encoded runs
npm: decode-uri-component vulnerable to denial of service via quadratic replacement of percent-encoded runs vulnerability discovered by ? in WordPress npm decode-uri-component versions = 0.5.0...
EUVD-2026-112471
decode-uri-component vulnerable to denial of service via quadratic replacement of percent-encoded runs...
CVE-2026-118664
decode-uri-component provides a more robust alternative to decodeURIComponent. Prior to 0.5.1, decodeUriComponent in index.js falls back to customDecodeURIComponent after native decoding throws, and the fallback collects every distinct percent-encoded run before performing a full-string...
CVE-2026-118664
The decode-uri-component library (prior to version 0.5.1 ) is vulnerable to a Denial of Service (DoS) attack. The issue resides in the decodeUriComponent function within index.js, where a fallback mechanism (customDecodeURIComponent) handles malformed input by collecting distinct percent-encoded ...
CVE-2026-118664 decode-uri-component: Denial of service via quadratic replacement of percent-encoded runs
decode-uri-component provides a more robust alternative to decodeURIComponent. Prior to 0.5.1, decodeUriComponent in index.js falls back to customDecodeURIComponent after native decoding throws, and the fallback collects every distinct percent-encoded run before performing a full-string...
CVE-2026-118664
decode-uri-component provides a more robust alternative to decodeURIComponent. Prior to 0.5.1, decodeUriComponent in index.js falls back to customDecodeURIComponent after native decoding throws, and the fallback collects every distinct percent-encoded run before performing a full-string...
CVE-2026-118664 decode-uri-component: Denial of service via quadratic replacement of percent-encoded runs
decode-uri-component provides a more robust alternative to decodeURIComponent. Prior to 0.5.1, decodeUriComponent in index.js falls back to customDecodeURIComponent after native decoding throws, and the fallback collects every distinct percent-encoded run before performing a full-string...
CVE-2026-118664: SamVerschueren decode-uri-component: decode-uri-component provides a more robust alternative to decodeURIComponent
decode-uri-component provides a more robust alternative to decodeURIComponent. Prior to 0.5.1, decodeUriComponent in index.js falls back to customDecodeURIComponent after native decoding throws, and the fallback collects every distinct percent-encoded run before performing a full-string...
PT-2026-129185
Name of the Vulnerable Software and Affected Versions decode-uri-component versions prior to 0.5.1 Description The decodeUriComponent function in index.js uses a fallback mechanism called customDecodeURIComponent when native decoding fails. This fallback process identifies every distinct...
AlmaLinux 9.2 [TuxCare] Security Update: pcs / pcs-snmp Multiple Vulnerabilities (ALMALINUX9.2:CLSA-2026:1792125039)
The AlmaLinux 9.2 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1792125039 advisory. - decode-uri-component 0.2.0 is vulnerable to Improper Input Validation resulting in DoS. CVE-2022-38900 - Rack is a modular Ruby we...
CentOS Linux 8.5 [TuxCare] Security Update: pcs / pcs-snmp Multiple Vulnerabilities (CENTOS8.5:CLSA-2026:1790611274)
The CentOS Linux 8.5 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare CENTOS8.5:CLSA-2026:1790611274 advisory. - A flaw was found in the Pacemaker configuration tool pcs. The pcs daemon was allowing expired accounts, and accounts with expired...
CentOS Linux 8.4 [TuxCare] Security Update: pcs / pcs-snmp Multiple Vulnerabilities (CENTOS8.4:CLSA-2026:1790610952)
The CentOS Linux 8.4 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare CENTOS8.4:CLSA-2026:1790610952 advisory. - A flaw was found in the Pacemaker configuration tool pcs. The pcs daemon was allowing expired accounts, and accounts with expired...
CLSA-2026-1790611274 pcs: Fix of 7 CVEs
CVE-2022-1049: fix pcsd PAM auth accepting expired accounts and passwords - CVE-2022-38900: fix DoS in decode of bundled decode-uri-component - CVE-2022-45442: fix reflected file download in bundled sinatra attachment - CVE-2023-27530: fix multipart part count DoS in rack via rack 2.2.20 -...
CLSA-2026-1790610952 pcs: Fix of 7 CVEs
CVE-2022-1049: fix pcsd PAM auth accepting expired accounts and passwords - CVE-2022-38900: fix DoS in decode of bundled decode-uri-component - CVE-2022-45442: fix reflected file download in bundled sinatra attachment - CVE-2023-27530: fix multipart part count DoS in rack via rack 2.2.20 -...
CLSA-2026-1788255041 TuxCare security update for decode-uri-component (1 CVE)
TuxCare rebuilt decode-uri-component to address 1 CVE. Fixed in 0.2.2-tuxcare.1...
PT-2026-89824
TuxCare rebuilt decode-uri-component to address 2 CVEs. Fixed in 0.2.2-tuxcare.1...
GHSA-VCC3-GHJQ-M6FR decode-uri-component: Denial of service via exponential decoding of malformed percent-encoded input
Impact An attacker who can supply input to decodeUriComponent directly or via a dependency that uses this package on URL/query/path data can cause excessive CPU usage and application unresponsiveness. This is an availability issue; there is no known memory corruption, data disclosure, or remote...