Description
An attacker who can supply input to decodeUriComponent() (directly or via a dependency that uses this package on URL/query/path data) can cause excessive CPU usage and application unresponsiveness. This is an availability issue; there is no known memory corruption, data disclosure, or remote code execution impact.
Recommendation
Update the decode-uri-component package to the latest compatible version. Followings are version details:
- Affected version(s): <= 0.4.2
- Patched version(s): 0.5.0
References
Could your website be exposed too?
SmartScanner can check your website for decode-uri-component: Denial of service via exponential decoding of malformed percent-encoded input and gives you actionable findings to investigate.
Start a free scanRelated Issues
- decode-uri-component vulnerable to denial of service via quadratic replacement of percent-encoded runs - CVE-2026-118664
- fast-uri vulnerable to URI scheme spoofing via percent-encoded scheme decoding - CVE-2026-110306
- decode-uri-component vulnerable to Denial of Service (DoS) - CVE-2022-38900
- React Router vulnerable to Denial of Service via reflected user input in single-fetch - CVE-2026-34077
You might also like:
See something that needs correcting? Let us knowUpdated August 31, 2026