{"action":"Upgrade decode-uri-component to 0.5.1 or later.","affected":[{"fixed":"0.5.1","introduced":"0"}],"component":"decode-uri-component","cve_ids":["CVE-2026-118664"],"ecosystem":"npm","epss":0.00318,"exploited":false,"fixed_versions":["0.5.1"],"ghsa_id":"GHSA-qr28-fpjm-wq7f","id":"tcs_01M64C124H6D6R5BZ5Q7Q8FBBW","modified_at":"2026-10-29T17:00:04.168610583Z","published_at":"2026-10-29T16:41:28Z","references":["https://osv.dev/vulnerability/GHSA-qr28-fpjm-wq7f","https://github.com/SamVerschueren/decode-uri-component/security/advisories/GHSA-qr28-fpjm-wq7f","https://nvd.nist.gov/vuln/detail/CVE-2026-118664","https://github.com/SamVerschueren/decode-uri-component/commit/fad01d65b93bd3f2f0dc32dfd8d57a38b57bc608","https://github.com/SamVerschueren/decode-uri-component","https://github.com/SamVerschueren/decode-uri-component/releases/tag/v0.5.1"],"severity":{"label":"high"},"sources":[{"source":"osv","source_id":"GHSA-qr28-fpjm-wq7f","url":"https://osv.dev/vulnerability/GHSA-qr28-fpjm-wq7f"}],"summary":"decode-uri-component vulnerable to denial of service via quadratic replacement of percent-encoded runs"}