CVE-2026-118664

The decode-uri-component library (prior to version 0.5.1 ) is vulnerable to a Denial of Service (DoS) attack. The issue resides in the decodeUriComponent function within index.js, where a fallback mechanism (customDecodeURIComponent) handles malformed input by collecting distinct percent-encoded ...

CVE-2026-118664 decode-uri-component: Denial of service via quadratic replacement of percent-encoded runs

decode-uri-component provides a more robust alternative to decodeURIComponent. Prior to 0.5.1, decodeUriComponent in index.js falls back to customDecodeURIComponent after native decoding throws, and the fallback collects every distinct percent-encoded run before performing a full-string...