Cloudanix VulnDB

CVE-2026-118664

None

CVSS

—

EPSS

0.3%

Published

Oct 28, 2026

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A library used to safely decode web addresses can be tricked by specially crafted bad addresses into using so much processing power that it slows down or stops the server.

Exploitation
Remote Unauthenticated
Attacker needs
None
Complexity
Low
Impact
Denial Of Service
Component
Library
Class
Denial of service
Remediation
Upgrade
Effort
Low
Patch risk
Low

What it actually does

Malformed percent-encoded input triggers quadratic CPU usage in the fallback decoder by collecting distinct runs and performing repeated full-string regex replacements, exhausting the Node.js event loop.

Why it matters to the business

Attackers can cause server unavailability and degraded performance on any service accepting untrusted request bodies or URLs that use this library, with the issue made public only two days ago.

How an attack unfolds

An attacker crafts input containing a large number of distinct percent-encoded sequences that cause the native decoder to throw; the fallback then performs an increasing number of full-string replacements whose total work grows quadratically with input size, blocking the event loop.

How to fix it

Upgrade decode-uri-component to version 0.5.1 or later; until then, validate or sanitize percent-encoded input before decoding or apply request-size limits on untrusted sources.

How to confirm the fix worked

Confirm the installed version is at least 0.5.1; test affected code paths with inputs containing many distinct percent-encoded sequences and verify that CPU time remains linear rather than quadratic.

Typical attack path

  1. Identify an endpoint that passes attacker-controlled data through decode-uri-component
  2. Generate a request body or query string containing many unique percent-encoded runs designed to trigger the fallback path
  3. Send the payload to force quadratic CPU consumption and block the event loop
  4. Repeat or sustain traffic to maintain denial of service

How to detect it

Look for Node.js processes showing sustained high CPU usage during URI decoding; correlate with request logs containing unusually long or repetitive percent-encoded sequences; examine stack traces pointing to index.js in decode-uri-component.

What your security team should do

  • Upgrade decode-uri-component to 0.5.1 immediately given the two-day-old public disclosure
  • Add input-size or complexity limits on any URI-decoding paths accepting untrusted data
  • Monitor Node.js processes for sudden CPU spikes correlated with request handling
  • Review dependency trees for any transitive use of the vulnerable package

The record

decode-uri-component provides a more robust alternative to decodeURIComponent. Prior to 0.5.1, decodeUriComponent in index.js falls back to customDecodeURIComponent after native decoding throws, and the fallback collects every distinct percent-encoded run before performing a full-string regular-expression replacement for each entry. Malformed input containing many distinct runs can therefore make both the number of replacements and the scanned input length grow together, causing quadratic CPU consumption and blocking the Node.js event loop; request-body inputs can reach the demonstrated size, while ordinary URL header limits reduce the practical delay. This issue is fixed in version 0.5.1.

Affected packages

Ecosystem Package Introduced Fixed

Related vulnerabilities