npm/decode-uri-component CVE-2026-118664: high, EPSS 0.32%
decode-uri-component vulnerable to denial of service via quadratic replacement of percent-encoded runs
Action: Upgrade decode-uri-component to 0.5.1 or later.
npm i decode-uri-component@0.5.1Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 0.5.1 | - |
Fixed versions
| 0.5.1 |
Sources
- osv: GHSA-qr28-fpjm-wq7f
- https://github.com/SamVerschueren/decode-uri-component/security/advisories/GHSA-qr28-fpjm-wq7f
- https://nvd.nist.gov/vuln/detail/CVE-2026-118664
- https://github.com/SamVerschueren/decode-uri-component/commit/fad01d65b93bd3f2f0dc32dfd8d57a38b57bc608
- https://github.com/SamVerschueren/decode-uri-component
- https://github.com/SamVerschueren/decode-uri-component/releases/tag/v0.5.1
CVE-2026-118664 · published · modified · JSON