npm/decode-uri-component CVE-2026-45822: medium 6.6, EPSS 0.51%

decode-uri-component: Denial of service via exponential decoding of malformed percent-encoded input

Action: Upgrade decode-uri-component to 0.5.0 or later.

npm i decode-uri-component@0.5.0

Affected

Fixed versions

Sources

• osv: GHSA-vcc3-ghjq-m6fr
• nvd: CVE-2026-45822
• https://github.com/SamVerschueren/decode-uri-component/security/advisories/GHSA-vcc3-ghjq-m6fr
• https://github.com/SamVerschueren/decode-uri-component/commit/fa479dafeede7bedf04e5c89aa78f2a78c664005
• https://github.com/SamVerschueren/decode-uri-component
• https://github.com/SamVerschueren/decode-uri-component/blob/00662938dc7c6241547ae8abce7785cc13ffd3f6/index.js
• https://github.com/SamVerschueren/decode-uri-component/releases/tag/v0.5.0
• https://www.npmjs.com/package/decode-uri-component

CVE-2026-45822 · published 2026-08-31T22:10:20Z · modified 2026-09-10T03:51:14.713899943Z · JSON