VYPR
← All advisories
High severityNVD Advisory· Published Nov 28, 2022· Updated Apr 25, 2025

CVE-2022-38900

CVE-2022-38900

Description

decode-uri-component 0.2.0 is vulnerable to Improper Input Validation resulting in DoS.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

decode-uri-component 0.2.0 has an improper input validation flaw that leads to denial of service via specially crafted URIs.

Vulnerability

Analysis

decode-uri-component version 0.2.0 contains an improper input validation vulnerability that can result in a denial of service (DoS) condition. The root cause lies in the decode function's handling of malformed percent-encoded sequences. When the function encounters a string that causes decodeURIComponent() to throw, it falls back to a manual parsing loop. In this loop, the input.match(singleMatcher) call could return null for certain malformed inputs, and the code attempted to iterate over tokens without checking for null, leading to a crash or hang. The fix, implemented in commit 746ca5d, adds || [] fallback for both tokens assignments, preventing the null reference.[1][3]

Exploitation

An attacker can trigger this vulnerability by providing a specially crafted URI containing malformed percent-encoding sequences. No authentication or special network position is required; the attack can be performed by any user or system that passes untrusted input to the affected decode function. For example, a token like %ea%ba%5a%ba was used in testing to demonstrate the issue, though the commit note indicates the fix may change behavior for such inputs to prevent the DoS.[3]

Impact

Successful exploitation causes the application to crash or become unresponsive, resulting in a denial of service. This can affect Node.js applications and any software using this library for URI decoding. The vulnerability does not lead to code execution, but the DoS can disrupt service availability.[1]

Mitigation

The vulnerability is patched in decode-uri-component version 0.2.1. Users should upgrade to this version or later. No known workarounds exist other than updating the library. The fix was released on the same day the CVE was published, and Fedora package announcements indicate distributions have been notified.[2][3][4]

References
  1. NVD - CVE-2022-38900
  2. Release v0.2.1 · SamVerschueren/decode-uri-component
  3. Fix issue where decode throws - fixes #6 · SamVerschueren/decode-uri-component@746ca5d
  4. Making sure you're not a bot!

AI Insight generated on May 21, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
decode-uri-componentnpm
< 0.2.10.2.1

Affected products

11

Patches

1
746ca5dcb666

Fix issue where decode throws - fixes #6

https://github.com/SamVerschueren/decode-uri-componentSam VerschuerenDec 1, 2022via ghsa
commit
2 files changed · +7 −4
  • index.js+3 −3 modified
    @@ -6,7 +6,7 @@ var multiMatcher = new RegExp('(' + token + ')+', 'gi');
 function decodeComponents(components, split) {
 	try {
 		// Try to decode the entire string first
-		return decodeURIComponent(components.join(''));
+		return [decodeURIComponent(components.join(''))];
 	} catch (err) {
 		// Do nothing
 	}
@@ -28,12 +28,12 @@ function decode(input) {
 	try {
 		return decodeURIComponent(input);
 	} catch (err) {
-		var tokens = input.match(singleMatcher);
+		var tokens = input.match(singleMatcher) || [];
 
 		for (var i = 1; i < tokens.length; i++) {
 			input = decodeComponents(tokens, i).join('');
 
-			tokens = input.match(singleMatcher);
+			tokens = input.match(singleMatcher) || [];
 		}
 
 		return input;
  • test.js+4 −1 modified
    @@ -32,7 +32,10 @@ const tests = {
 	'%C2x': '\uFFFDx',
 	'%C2%B5': 'µ',
 	'%C2%B5%': 'µ%',
-	'%%C2%B5%': '%µ%'
+	'%%C2%B5%': '%µ%',
+
+	// This should actually return `%ea%baZ%ba`, but fixes a DOS attack for now
+	'%ea%ba%5a%ba': '꺺'
 };
 
 function macro(t, input, expected) {

Vulnerability mechanics

Generated on May 9, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.

References

16

News mentions

0

No linked articles in our index yet.