CVE-2026-118664: decode-uri-component vulnerable to denial of service via quadratic replacement of percent-encoded runs
decodeUriComponent() takes quadratic time on malformed input that has many distinct percent-encoded runs. A single unauthenticated request of about 224 KB can block the Node.js event loop for about 20 seconds. Version 0.5.0, the release that fixed CVE-2026-45822, is affected.
References
- github.com/SamVerschueren/decode-uri-component/commit/fad01d65b93bd3f2f0dc32dfd8d57a38b57bc608
- github.com/SamVerschueren/decode-uri-component/releases/tag/v0.5.1
- github.com/SamVerschueren/decode-uri-component/security/advisories/GHSA-qr28-fpjm-wq7f
- github.com/advisories/GHSA-qr28-fpjm-wq7f
- nvd.nist.gov/vuln/detail/CVE-2026-118664
Code Behaviors & Features
Detect and mitigate CVE-2026-118664 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →