Decode Uri Component
Monthly
Quadratic CPU consumption in the npm package decode-uri-component 0.5.0 and earlier lets unauthenticated remote attackers stall the Node.js event loop by supplying malformed percent-encoded input that contains many distinct encoded runs plus a single sequence the native decoder rejects, forcing a fallback path that runs one full-string regular-expression replacement per distinct run. A payload of roughly 224 KB blocks the process for about 20 seconds, but Node's default 16 KB header limit throttles URL-derived input to roughly 40 ms per request, so full impact requires an application that decodes request bodies, such as form bodies parsed with query-string.parse(). The flaw is fixed in 0.5.1, which replaces the replacement loop with a single-pass in-place decode; a public proof-of-concept snippet accompanies the vendor advisory, and it is not verified as working exploit code. Exploitation status: no confirmed active exploitation (not in CISA KEV).
Super-linear algorithmic complexity in the decode-uri-component npm package (versions through 0.4.1) allows unauthenticated network attackers to cause severe CPU exhaustion and block the Node.js event loop by submitting crafted strings with large numbers of percent-encoded tokens. The decode() function splits input on '%' and iteratively invokes decodeComponents() in a pattern producing quadratic or worse time growth - 1,400 '%ab' tokens consume approximately 33 seconds of CPU, rendering single-threaded JavaScript runtimes effectively unresponsive. No public exploit is confirmed at time of analysis (CVSS E:U), but the deterministic algorithmic nature makes payload construction trivial for any attacker with a reachable input channel.
decode-uri-component 0.2.0 is vulnerable to Improper Input Validation resulting in DoS. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Quadratic CPU consumption in the npm package decode-uri-component 0.5.0 and earlier lets unauthenticated remote attackers stall the Node.js event loop by supplying malformed percent-encoded input that contains many distinct encoded runs plus a single sequence the native decoder rejects, forcing a fallback path that runs one full-string regular-expression replacement per distinct run. A payload of roughly 224 KB blocks the process for about 20 seconds, but Node's default 16 KB header limit throttles URL-derived input to roughly 40 ms per request, so full impact requires an application that decodes request bodies, such as form bodies parsed with query-string.parse(). The flaw is fixed in 0.5.1, which replaces the replacement loop with a single-pass in-place decode; a public proof-of-concept snippet accompanies the vendor advisory, and it is not verified as working exploit code. Exploitation status: no confirmed active exploitation (not in CISA KEV).
Super-linear algorithmic complexity in the decode-uri-component npm package (versions through 0.4.1) allows unauthenticated network attackers to cause severe CPU exhaustion and block the Node.js event loop by submitting crafted strings with large numbers of percent-encoded tokens. The decode() function splits input on '%' and iteratively invokes decodeComponents() in a pattern producing quadratic or worse time growth - 1,400 '%ab' tokens consume approximately 33 seconds of CPU, rendering single-threaded JavaScript runtimes effectively unresponsive. No public exploit is confirmed at time of analysis (CVSS E:U), but the deterministic algorithmic nature makes payload construction trivial for any attacker with a reachable input channel.
decode-uri-component 0.2.0 is vulnerable to Improper Input Validation resulting in DoS. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.