CVE-2026-45822

Name of the Vulnerable Software and Affected Versions decode-uri-component versions 0.4.1 and earlier

Description A denial of service issue exists where the decode() function splits input based on the '%' character, creating N tokens that are then processed by decodeComponents(). This process results in super-linear parsing time, where increasing the number of tokens significantly increases processing time (e.g., 200 tokens take 0.7s, while 1400 tokens take 33s). An attacker can exploit this by providing crafted input to cause high CPU consumption and block the event-loop.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.