[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
decode-uri-component	0.5.0 → 0.5.1

---

decode-uri-component vulnerable to denial of service via quadratic replacement of percent-encoded runs

CVE-2026-118664 / GHSA-qr28-fpjm-wq7f

More information

Details

Summary

decodeUriComponent() takes quadratic time on malformed input that has many distinct percent-encoded runs. A single unauthenticated request of about 224 KB can block the Node.js event loop for about 20 seconds. Version 0.5.0, the release that fixed CVE-2026-45822, is affected.

Details

When native decodeURIComponent throws, decodeUriComponent() falls back to customDecodeURIComponent (index.js:122). That function:

1. Scans the input for every run of percent-encoded bytes (e.g. %C3%A5) and stores each distinct run, with its decoded value, in a lookup table (index.js:130-144).
2. Runs one full-string input.replace(new RegExp(key, 'g'), …) per table entry (index.js:154).

With K distinct runs in an input of length L, that's K regex compilations and K full scans of the string, so O(K·L). An attacker controls both K and L, and K grows with L. One malformed sequence such as a trailing %zz is enough to force the fallback path.

The 0.5.0 fix for CVE-2026-45822 (fa479da) replaced the recursive decode() routine with a linear scanner, but left this replacement loop unchanged.

Proof of concept

Running the following code takes ~20 seconds.

import decodeUriComponent from 'decode-uri-component';

let payload = '';
for (let i = 0; i < 32000; i++) {
	const high = Math.floor(i / 256).toString(16).padStart(2, '0');
	const low = (i % 256).toString(16).padStart(2, '0');
	payload += `%${high}%${low}x`; // distinct run each iteration
}
payload += '%zz'; // forces the fallback decoder

console.time('decode');
decodeUriComponent(payload); // ~224 KB
console.timeEnd('decode');

Impact

This is an availability issue only and there's no confidentiality or integrity impact. Any application that passes untrusted input to decodeUriComponent(), directly or through a dependency such as query-string, can be made unresponsive. Because Node.js runs on one thread, one request stalls every other client.

The worst case needs input well beyond URL length limits. Node's default 16 KB header limit keeps payloads passed in via a URL query string to roughly 40 ms per request. Applications that decode request bodies are fully exposed, for example form bodies parsed with query-string.parse().

Severity

• CVSS Score: 8.2 / 10 (High)
• Vector String: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

References

• https://github.com/SamVerschueren/decode-uri-component/security/advisories/GHSA-qr28-fpjm-wq7f
• https://nvd.nist.gov/vuln/detail/CVE-2026-118664
• https://github.com/SamVerschueren/decode-uri-component/commit/fad01d65b93bd3f2f0dc32dfd8d57a38b57bc608
• https://github.com/SamVerschueren/decode-uri-component/releases/tag/v0.5.1
• https://github.com/advisories/GHSA-qr28-fpjm-wq7f

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Release Notes

SamVerschueren/decode-uri-component (decode-uri-component)

v0.5.1

Compare Source

• Decode percent-encoded runs in a single pass fad01d6

---

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.