decode-uri-component CVE-2026-118664

The affected application must pass attacker-controlled input to decodeUriComponent() from decode-uri-component <=0.5.0, either directly or through a dependency such as query-string (e.g. query-string.parse()). The malformed input must contain many distinct percent-encoded runs and at least one sequence that native decodeURIComponent rejects (such as a trailing %zz) to force the customDecodeURIComponent fallback path. Full ~20-second impact requires delivering roughly 224 KB of such input, which is practical only where request bodies are decoded; exposure via URL query strings is throttled by Node's default 16 KB header limit to about 40 ms per request, substantially limiting impact. No authentication or user interaction is required (PR:N/UI:N). The only complete fix per the vendor is upgrading to 0.5.1.

This is a genuine but bounded availability risk, not a top-tier emergency. The CVSS 4.0 vector (AV:N/AC:L/AT:P/PR:N/UI:N) with VA:H and all confidentiality/integrity metrics N confirms a network-reachable, unauthenticated denial-of-service with no data exposure; the AT:P (attack requirement) aligns with the advisory's statement that full impact requires a path that accepts large request-body input rather than URL-length-limited query strings. No EPSS score and no KEV listing were provided, so there is no signal of widespread or confirmed active exploitation; the vuln.today decision label is 'this_week', consistent with important-but-not-immediate prioritization. A proof-of-concept is published in the GHSA advisory demonstrating ~20 seconds of event-loop blocking from a single ~224 KB request. The practical severity hinges entirely on deployment: applications decoding untrusted request bodies (e.g. form bodies via query-string.parse()) are fully exposed, whereas inputs confined to URL query strings under Node's default 16 KB header limit degrade to roughly 40 ms per request - a far smaller impact. So the headline 8.2 is realistic only for body-decoding deployments; URL-only exposure is materially lower risk. No conflicting signals, but note EPSS/KEV data is simply absent rather than confirming low exploitation.

An attacker sends a single unauthenticated HTTP request whose body contains tens of thousands of distinct malformed percent-encoded runs (about 224 KB) terminated by an invalid sequence such as %zz. An application that decodes that body with decodeUriComponent - directly or via a dependency like query-string - enters the quadratic fallback decoder, blocking Node's single event-loop thread for ~20 seconds and stalling all other clients. A working proof-of-concept is published in the GHSA advisory, though it is not verified as a packaged working exploit.