SamVerschueren decode-uri-component up to 0.4.x decode resource consumption

Summaryinfo

A vulnerability categorized as problematic has been discovered in SamVerschueren decode-uri-component up to 0.4.x. This affects the function decode. Such manipulation leads to resource consumption. This vulnerability is documented as CVE-2026-45822. The attack can be executed remotely. There is not any exploit available. It is advisable to upgrade the affected component.

Detailsinfo

A vulnerability, which was classified as problematic, has been found in SamVerschueren decode-uri-component up to 0.4.x. Affected by this issue is the function decode. The manipulation with an unknown input leads to a resource consumption vulnerability. Using CWE to declare the problem leads to CWE-400. The product does not properly control the allocation and maintenance of a limited resource, thereby enabling an actor to influence the amount of resources consumed, eventually leading to the exhaustion of available resources. Impacted is availability. CVE summarizes:

decode-uri-component through 0.4.1 is vulnerable to denial of service. The decode() function splits input on '%' producing N tokens and calls decodeComponents(), exhibiting super-linear parsing time: 200 '%ab' tokens takes approximately 0.7s, 700 tokens approximately 6s, and 1400 tokens approximately 33s. An attacker can cause significant CPU consumption and event-loop blocking via crafted input.

The advisory is shared for download at github.com. This vulnerability is handled as CVE-2026-45822 since 05/13/2026. The exploitation is known to be easy. The attack may be launched remotely. No form of authentication is required for exploitation. There are known technical details, but no exploit is available. The MITRE ATT&CK project declares the attack technique as T1499.

Upgrading to version 0.5.0 eliminates this vulnerability. Applying the patch fa479dafeede7bedf04e5c89aa78f2a78c664005 is able to eliminate this problem. The bugfix is ready for download at github.com. The best possible mitigation is suggested to be upgrading to the latest version.

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Productinfo

Vendor

• SamVerschueren

Name

• decode-uri-component

Version

• 0.1
• 0.2
• 0.3
• 0.4

License

• open-source

Website

• Product: https://github.com/SamVerschueren/decode-uri-component/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Discussion