Denial of Service Vulnerability in decode-uri-component by Sam Verschueren

CVE-2026-118664

What is CVE-2026-118664?

The decode-uri-component library, prior to version 0.5.1, is vulnerable to a Denial of Service (DoS) due to its handling of malformed URI-encoded input. When the decodeUriComponent function encounters errors during native decoding, it falls back on a custom decoding strategy that may inadvertently lead to excessive CPU consumption. Specifically, if the input contains multiple distinct percent-encoded sequences, this may trigger numerous replacements and prolong the processing time, eventually blocking the Node.js event loop. This vulnerability can be particularly exploited through crafted request bodies, underscoring the importance of updating to version 0.5.1 or later to mitigate this risk.

References