Denial of Service Vulnerability in decode-uri-component by Sam Verschueren

CVE-2026-45822

What is CVE-2026-45822?

The decode-uri-component library, used for decoding URI components, is susceptible to a denial of service attack. Specifically, the decode() function can lead to super-linear parsing times due to how it processes input. For instance, providing multiple '%ab' tokens can vastly increase CPU usage and result in unresponsive application behavior. An attacker can exploit this vulnerability by sending specially crafted input, significantly impacting performance and leading to potential service downtime.

References