GHSA-QR28-FPJM-WQ7F
Vulnerability from github – Published: 2026-10-29 16:41 – Updated: 2026-10-29 16:41Summary
decodeUriComponent() takes quadratic time on malformed input that has many distinct percent-encoded runs. A single unauthenticated request of about 224 KB can block the Node.js event loop for about 20 seconds. Version 0.5.0, the release that fixed CVE-2026-45822, is affected.
Details
When native decodeURIComponent throws, decodeUriComponent() falls back to customDecodeURIComponent (index.js:122). That function:
1. Scans the input for every run of percent-encoded bytes (e.g. %C3%A5) and stores each distinct run, with its decoded value, in a lookup table (index.js:130-144).
2. Runs one full-string input.replace(new RegExp(key, 'g'), …) per table entry (index.js:154).
With K distinct runs in an input of length L, that's K regex compilations and K full scans of the string, so O(K·L). An attacker controls both K and L, and K grows with L. One malformed sequence such as a trailing %zz is enough to force the fallback path.
The 0.5.0 fix for CVE-2026-45822 (fa479da) replaced the recursive decode() routine with a linear scanner, but left this replacement loop unchanged.
Proof of concept
Running the following code takes ~20 seconds.
import decodeUriComponent from 'decode-uri-component';
let payload = '';
for (let i = 0; i < 32000; i++) {
const high = Math.floor(i / 256).toString(16).padStart(2, '0');
const low = (i % 256).toString(16).padStart(2, '0');
payload += `%${high}%${low}x`; // distinct run each iteration
}
payload += '%zz'; // forces the fallback decoder
console.time('decode');
decodeUriComponent(payload); // ~224 KB
console.timeEnd('decode');
Impact
This is an availability issue only and there's no confidentiality or integrity impact. Any application that passes untrusted input to decodeUriComponent(), directly or through a dependency such as query-string, can be made unresponsive. Because Node.js runs on one thread, one request stalls every other client.
The worst case needs input well beyond URL length limits. Node's default 16 KB header limit keeps payloads passed in via a URL query string to roughly 40 ms per request. Applications that decode request bodies are fully exposed, for example form bodies parsed with query-string.parse().
{
"affected": [
{
"database_specific": {
"last_known_affected_version_range": "\u003c= 0.5.0"
},
"package": {
"ecosystem": "npm",
"name": "decode-uri-component"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "0.5.1"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2026-118664"
],
"database_specific": {
"cwe_ids": [
"CWE-400",
"CWE-407"
],
"github_reviewed": true,
"github_reviewed_at": "2026-10-29T16:41:28Z",
"nvd_published_at": "2026-10-28T21:16:56Z",
"severity": "HIGH"
},
"details": "### Summary\n\n`decodeUriComponent()` takes quadratic time on malformed input that has many distinct percent-encoded runs. A single unauthenticated request of about 224 KB can block the Node.js event loop for about 20 seconds. Version 0.5.0, the release that fixed CVE-2026-45822, is affected.\n\n### Details\n\nWhen native decodeURIComponent throws, `decodeUriComponent()` falls back to `customDecodeURIComponent` (`index.js:122`). That function:\n1. Scans the input for every run of percent-encoded bytes (e.g. `%C3%A5`) and stores each distinct run, with its decoded value, in a lookup table (`index.js:130-144`).\n2. Runs one full-string `input.replace(new RegExp(key, \u0027g\u0027), \u2026)` per table entry (`index.js:154`).\n\nWith K distinct runs in an input of length L, that\u0027s K regex compilations and K full scans of the string, so O(K\u00b7L). An attacker controls both K and L, and K grows with L. One malformed sequence such as a trailing `%zz` is enough to force the fallback path.\n\nThe 0.5.0 fix for CVE-2026-45822 (`fa479da`) replaced the recursive `decode()` routine with a linear scanner, but left this replacement loop unchanged.\n\n### Proof of concept\n\nRunning the following code takes ~20 seconds.\n\n```js\nimport decodeUriComponent from \u0027decode-uri-component\u0027;\n\nlet payload = \u0027\u0027;\nfor (let i = 0; i \u003c 32000; i++) {\n\tconst high = Math.floor(i / 256).toString(16).padStart(2, \u00270\u0027);\n\tconst low = (i % 256).toString(16).padStart(2, \u00270\u0027);\n\tpayload += `%${high}%${low}x`; // distinct run each iteration\n}\npayload += \u0027%zz\u0027; // forces the fallback decoder\n\nconsole.time(\u0027decode\u0027);\ndecodeUriComponent(payload); // ~224 KB\nconsole.timeEnd(\u0027decode\u0027);\n```\n\n### Impact\n\nThis is an availability issue only and there\u0027s no confidentiality or integrity impact. Any application that passes untrusted input to `decodeUriComponent()`, directly or through a dependency such as `query-string`, can be made unresponsive. Because Node.js runs on one thread, one request stalls every other client.\n\nThe worst case needs input well beyond URL length limits. Node\u0027s default 16 KB header limit keeps payloads passed in via a URL query string to roughly 40 ms per request. Applications that decode request bodies are fully exposed, for example form bodies parsed with `query-string.parse()`.",
"id": "GHSA-qr28-fpjm-wq7f",
"modified": "2026-10-29T16:41:28Z",
"published": "2026-10-29T16:41:28Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/SamVerschueren/decode-uri-component/security/advisories/GHSA-qr28-fpjm-wq7f"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-118664"
},
{
"type": "WEB",
"url": "https://github.com/SamVerschueren/decode-uri-component/commit/fad01d65b93bd3f2f0dc32dfd8d57a38b57bc608"
},
{
"type": "PACKAGE",
"url": "https://github.com/SamVerschueren/decode-uri-component"
},
{
"type": "WEB",
"url": "https://github.com/SamVerschueren/decode-uri-component/releases/tag/v0.5.1"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"type": "CVSS_V4"
}
],
"summary": "decode-uri-component vulnerable to denial of service via quadratic replacement of percent-encoded runs"
}
Drag nodes to arrange them. Double-click a related vulnerability to open it, or a source to visit its link. The Physics button on the left tunes the layout and the simulation; the legend at the bottom left hides or shows nodes by kind and by sighting type.
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Vulnerability timeline
Sightings and recorded dates, grouped by day · UTC
Loading timeline…
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
Related by attack behaviour
Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.