Skip to content
OpenAdvisories

Package · npm

decode-uri-component

3 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

3 results · Feed

  • High 8.2
    CVE-2026-118664

    decode-uri-component: Denial of service via quadratic replacement of percent-encoded runs

    decode-uri-component provides a more robust alternative to decodeURIComponent. Prior to 0.5.1, decodeUriComponent in index.js falls back to customDecodeURIComponent after native decoding throws, and the fallback collects every distinct percent-encoded run bef…

    SamVerschueren decode-uri-component decode-uri-component npm
  • Medium 6.6
    CVE-2026-45822

    decode-uri-component: Denial of service via exponential decoding of malformed percent-encoded input

    decode-uri-component through 0.4.1 is vulnerable to denial of service. The decode() function splits input on '%' producing N tokens and calls decodeComponents(), exhibiting super-linear parsing time: 200 '%ab' tokens takes approximately 0.7s, 700 tokens appro…

    SamVerschueren decode-uri-component decode-uri-component node-source-map-resolve Ubuntu npm
  • High 7.5
    CVE-2022-38900 EPSS 23%

    decode-uri-component vulnerable to Denial of Service (DoS)

    decode-uri-component 0.2.0 is vulnerable to Improper Input Validation resulting in DoS.

    decode-uri-component npm