CVE-2026-118664 in decode-uri-component
Summary
by MITRE • 10/28/2026
decode-uri-component provides a more robust alternative to decodeURIComponent. Prior to 0.5.1, decodeUriComponent in index.js falls back to customDecodeURIComponent after native decoding throws, and the fallback collects every distinct percent-encoded run before performing a full-string regular-expression replacement for each entry. Malformed input containing many distinct runs can therefore make both the number of replacements and the scanned input length grow together, causing quadratic CPU consumption and blocking the Node.js event loop; request-body inputs can reach the demonstrated size, while ordinary URL header limits reduce the practical delay. This issue is fixed in version 0.5.1.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 10/28/2026
The decode-uri-component library serves as a robust alternative to the native JavaScript decodeURIComponent function, designed to handle edge cases that standard decoding might fail on. However, versions prior to 0.5.1 contain a critical algorithmic flaw in their fallback mechanism within index.js. When the native decoder throws an error due to malformed input, the library attempts to manually parse and replace percent-encoded sequences using regular expressions. The implementation collects every distinct percent-encoded run from the input string before performing full-string replacements for each entry found. This approach creates a significant performance vulnerability because both the number of replacement operations and the length of the scanned input grow in tandem as the complexity of the malformed input increases.
This architectural flaw results in quadratic CPU consumption, effectively creating a ReDoS-like scenario where processing time scales exponentially with the size or complexity of the malicious payload. An attacker can exploit this by submitting request bodies containing many distinct percent-encoded runs to trigger the fallback logic repeatedly. While standard URL header limits often restrict the practical delay achievable through HTTP headers, direct POST body inputs are not subject to these same constraints and can reach sizes sufficient to demonstrate severe performance degradation. The resulting effect is a denial of service condition where the Node.js event loop becomes blocked, preventing the application from processing other concurrent requests and rendering the service unresponsive for legitimate users.
From a classification perspective, this vulnerability aligns with CWE-400, which covers Uncontrolled Resource Consumption, specifically manifesting as CPU exhaustion through inefficient algorithmic complexity. In terms of attack vectors, it corresponds to ATT&CK technique T1496, Resource Hijacking, where an attacker consumes system resources to disrupt availability rather than compromising confidentiality or integrity directly. The impact is primarily on the Availability pillar of the CIA triad, leading to service degradation or complete outage depending on the volume and frequency of malicious requests received by the server.
To mitigate this risk, organizations must immediately upgrade the decode-uri-component package to version 0.5.1 or later, where the fallback logic has been corrected to prevent quadratic behavior. For applications that cannot update dependencies instantly due to compatibility constraints, implementing input validation at the network perimeter is recommended. This includes enforcing strict length limits on request bodies and rejecting payloads with an excessive number of percent-encoded sequences before they reach the application layer. Additionally, deploying Web Application Firewalls configured to detect anomalous encoding patterns can provide a secondary line of defense against such resource exhaustion attacks until the underlying software vulnerability is patched.