CVE-2026-118664

Name of the Vulnerable Software and Affected Versions decode-uri-component versions prior to 0.5.1

Description The decodeUriComponent function in index.js uses a fallback mechanism called customDecodeURIComponent when native decoding fails. This fallback process identifies every distinct percent-encoded sequence and performs a full-string regular-expression replacement for each one. When provided with malformed input containing numerous distinct sequences, the number of replacements and the length of the scanned input increase simultaneously. This results in quadratic CPU consumption, which can block the Node.js event loop. While URL header limits may reduce the delay, inputs within the request body can reach sizes that trigger this behavior.

Recommendations Update to version 0.5.1.