MEDIUMCVSS 6.6EPSS 0.5%

CVE-2026-45822

CVE-2026-45822 updated by NVD

Published: 2026-08-31
Modified: 2026-10-27
EPSS percentile: 41%
Sources: github-advisory, nvd

Summary

decode-uri-component through 0.4.1 is vulnerable to denial of service. The decode() function splits input on '%' producing N tokens and calls decodeComponents(), exhibiting super-linear parsing time: 200 '%ab' tokens takes approximately 0.7s, 700 tokens approximately 6s, and 1400 tokens approximately 33s. An attacker can cause significant CPU consumption and event-loop blocking via crafted input.

Affected packages

Ecosystem	Package	Affected versions	Fixed versions
npm	decode-uri-component	—	0.5.0

Remediation: Upgrade to 0.5.0 or later.

References

https://nvd.nist.gov/vuln/detail/CVE-2026-45822

Includes data from the GitHub Advisory Database, licensed under CC-BY 4.0.

Includes data from the National Vulnerability Database (NIST). NVD data is in the public domain; this page is not endorsed by NIST.

CVE® is a registered trademark of The MITRE Corporation. CVE content reproduced under the CVE Terms of Use; copyright designation © MITRE.

EPSS scores provided by the FIRST.org Exploit Prediction Scoring System.