decode-uri-component EUVD-2026-40267

The vulnerable application must route attacker-controlled string input to decode-uri-component's decode() function specifically - the native decodeURIComponent() is not affected. No authentication is required (PR:N), no special configuration is needed, and no non-default setup is implied. The CVSS vector (AV:N/AC:L/AT:N/PR:N/UI:N) confirms exploitation is possible from the network against default conditions. Factors that limit exploitation: (1) the application must actually call decode-uri-component's decode() rather than the native built-in; (2) there must be a network-reachable input path - e.g., a query parameter, form field, or path segment - that reaches the decode() call without prior length or format validation; (3) the DoS severity is proportional to payload size - 200 tokens produce approximately 0.7 seconds of blocking versus 33 seconds for 1,400 tokens, so smaller inputs cause partial rather than complete denial. Applications that sanitize or truncate inputs before decode() calls are not exploitable in practice.

The CVSS 4.0 base vector (AV:N/AC:L/AT:N/PR:N/UI:N/VA:H) is consistent with the description: exploitation requires no authentication, no special attack conditions, and no user interaction, while producing high availability impact. The CVSS 4.0 base score of 6.6 (Medium) appropriately reflects a pure DoS with no confidentiality or integrity compromise. CVSS E:U confirms no exploits observed at scoring time, and no CISA KEV listing is indicated in the provided data, placing this in the 'known algorithmic flaw, not actively weaponized at scale' category. No EPSS data was provided, so exploitation probability cannot be quantified. The primary practical risk driver is transitive dependency exposure: applications may unknowingly consume this library through upstream packages and pass user-controlled strings into the decode path without sanitization. The attack is low-complexity to construct given the precise timing benchmarks published in the description, which effectively function as a proof-of-concept payload specification. CVSS vector and description are fully consistent - no contradictions to flag.

An attacker identifies a web endpoint that passes user-supplied URL query parameters or path components through decode-uri-component's decode() function. The attacker submits an HTTP request containing a query string composed of approximately 1,400 repetitions of '%ab', triggering roughly 33 seconds of CPU blocking on the target's Node.js event loop per request. Staggering a small number of such requests across the blocking window sustains the denial, preventing all concurrent legitimate requests from being processed without requiring any credentials or prior reconnaissance beyond identifying the endpoint.