Skip to main content

decode-uri-component CVE-2026-45822

| EUVDEUVD-2026-40267 MEDIUM
Uncontrolled Resource Consumption (CWE-400)
2026-06-30 seal GHSA-vcc3-ghjq-m6fr
Denial Of Service Red Hat Suse Decode Uri Component
6.6
CVSS 4.0 · Vendor: seal
Share

Severity by source

Vendor (seal) PRIMARY
6.6 MEDIUM
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:N/AU:Y/R:U/V:D/RE:M/U:Amber
vuln.today AI
7.5 HIGH

Network-reachable decode() input path, no auth or interaction required; scope unchanged, only availability impacted via event-loop blocking.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
SUSE
5.3 MEDIUM
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Red Hat
7.5 HIGH
qualitative

Primary rating from Vendor (seal).

CVSS VectorVendor: seal

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
N

Lifecycle Timeline

2
Patch available
Jun 30, 2026 - 10:01 EUVD
Analysis Generated
Jun 30, 2026 - 09:00 vuln.today

Blast Radius

ecosystem impact
† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth
  • 1,412 npm packages depend on decode-uri-component (5 direct, 1,407 indirect)

Ecosystem-wide dependent count for version 0.5.0.

DescriptionCVE.org

decode-uri-component through 0.4.1 is vulnerable to denial of service. The decode() function splits input on '%' producing N tokens and calls decodeComponents(), exhibiting super-linear parsing time: 200 '%ab' tokens takes approximately 0.7s, 700 tokens approximately 6s, and 1400 tokens approximately 33s. An attacker can cause significant CPU consumption and event-loop blocking via crafted input.

AnalysisAI

Super-linear algorithmic complexity in the decode-uri-component npm package (versions through 0.4.1) allows unauthenticated network attackers to cause severe CPU exhaustion and block the Node.js event loop by submitting crafted strings with large numbers of percent-encoded tokens. The decode() function splits input on '%' and iteratively invokes decodeComponents() in a pattern producing quadratic or worse time growth - 1,400 '%ab' tokens consume approximately 33 seconds of CPU, rendering single-threaded JavaScript runtimes effectively unresponsive. No public exploit is confirmed at time of analysis (CVSS E:U), but the deterministic algorithmic nature makes payload construction trivial for any attacker with a reachable input channel.

Technical ContextAI

The affected component is the decode-uri-component npm package by SamVerschueren (CPE: cpe:2.3:a:samverschueren:decode-uri-component:*), a JavaScript/Node.js utility that extends native decodeURIComponent() with more robust handling of malformed percent-encoded sequences. The root cause maps to CWE-400 (Uncontrolled Resource Consumption): the decode() function in index.js splits the input string on the '%' delimiter to produce N tokens, then drives each through decodeComponents() in a loop whose cumulative work scales super-linearly with the number of tokens. This is a classic algorithmic complexity (ReDoS-adjacent) vulnerability - unlike regex-based ReDoS, the attack surface is a URL parsing utility likely to receive attacker-controlled query parameters, path segments, or encoded form values in any Node.js web application that depends on this package directly or transitively. The source of the vulnerability is visible in the referenced commit at index.js (fa479dafeede7bedf04e5c89aa78f2a78c664005).

RemediationAI

Upgrade decode-uri-component to a version newer than 0.4.1, verifying the current latest release at https://www.npmjs.com/package/decode-uri-component before updating, as the upstream fix commit (fa479dafeede7bedf04e5c89aa78f2a78c664005) is confirmed but the corresponding npm release version is not independently verified from provided data. Run npm ls decode-uri-component or npm audit to surface all transitive dependencies on this package, as indirect dependents may not be immediately visible. As a compensating control prior to patching, enforce input length limits or reject strings with an excessive number of percent-encoded sequences before they reach the decode() call - this directly caps the quadratic growth and limits per-request CPU impact. Applying request body and query-string size limits at the reverse proxy or API gateway layer (e.g., nginx client_max_body_size, or express body-parser limits) adds a second line of defense with no application-level changes required, though it does not eliminate the vulnerability for inputs within normal size bounds.

More in Decode Uri Component

View all
CVE-2022-38900 HIGH POC
7.5 Nov 28

decode-uri-component 0.2.0 is vulnerable to Improper Input Validation resulting in DoS. Rated high severity (CVSS 7.5),

Same weakness CWE-400 – Uncontrolled Resource Consumption

View all
CVE-2023-44487 HIGH POC
7.5
CVE-2026-45498 HIGH POC
7.5
CVE-2016-8610 HIGH
7.5
CVE-2026-28318 HIGH POC
7.5
CVE-2023-38180 HIGH
7.5
CVE-2025-26673 HIGH
7.5
CVE-2015-7978 HIGH
7.5
CVE-2025-27473 HIGH
7.5

Same technique Denial Of Service

View all
CVE-2015-5119 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2011-0611 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8
CVE-2012-0507 CRITICAL POC
9.8
CVE-2014-1761 HIGH POC
7.8
CVE-2015-5122 CRITICAL POC
9.8
CVE-2011-0609 HIGH POC
7.8

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise High Performance Computing 12 Not-Affected
SUSE Linux Enterprise High Performance Computing 15 SP7 Not-Affected
SUSE Linux Enterprise High Performance Computing 15 SP7 Not-Affected
SUSE Linux Enterprise High Performance Computing 15 SP7 Affected

Share

CVE-2026-45822 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy