Medium severityNVD Advisory· Published Jun 30, 2026· Updated Jun 30, 2026
CVE-2026-45822
CVE-2026-45822
Description
decode-uri-component through 0.4.1 is vulnerable to denial of service. The decode() function splits input on '%' producing N tokens and calls decodeComponents(), exhibiting super-linear parsing time: 200 '%ab' tokens takes approximately 0.7s, 700 tokens approximately 6s, and 1400 tokens approximately 33s. An attacker can cause significant CPU consumption and event-loop blocking via crafted input.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
decode-uri-componentnpm | < 0.5.0 | 0.5.0 |
Affected products
26- osv-coords24 versionspkg:apk/chainguard/gitlab-rails-ce-19.3pkg:apk/chainguard/sqlpadpkg:npm/decode-uri-componentpkg:apk/chainguard/gitlab-rails-ce-fips-19.3pkg:apk/chainguard/kibana-9.4pkg:apk/chainguard/kibana-9.5pkg:apk/chainguard/kibana-9.5-iamguardedpkg:apk/chainguard/vitess-22pkg:apk/chainguard/vitess-23pkg:apk/chainguard/vitess-24pkg:apk/chainguard/wazuh-dashboard-alerting-dashboards-plugin-fipspkg:apk/chainguard/wazuh-dashboard-anomaly-detection-dashboards-plugin-fipspkg:apk/chainguard/wazuh-dashboard-dashboards-reporting-fipspkg:apk/chainguard/wazuh-dashboard-fipspkg:apk/chainguard/wazuh-dashboard-index-management-dashboards-plugin-fipspkg:apk/wolfi/sqlpadpkg:apk/chainguard/opensearch-dashboards-3-fips-alerting-dashboards-pluginpkg:apk/wolfi/vitess-23pkg:apk/chainguard/gitlab-rails-ce-fips-18.11pkg:apk/chainguard/kibana-9.4-iamguardedpkg:apk/wolfi/vitess-24pkg:apk/chainguard/nextcloud-server-34pkg:apk/chainguard/gitlab-rails-ce-fips-18.7pkg:apk/chainguard/dotstatsuite-supercore
< 19.3.1-r6+ 23 more
- (no CPE)range: < 19.3.1-r6
- (no CPE)range: < 7.5.7-r34
- (no CPE)range: < 0.5.0
- (no CPE)range: < 19.3.1-r3
- (no CPE)range: < 9.4.6-r1
- (no CPE)range: < 9.5.2-r3
- (no CPE)range: < 9.5.2-r3
- (no CPE)range: < 22.0.4-r21
- (no CPE)range: < 23.0.6-r3
- (no CPE)range: < 24.0.2-r17
- (no CPE)range: < 4.14.7-r15
- (no CPE)range: < 4.14.7-r15
- (no CPE)range: < 4.14.7-r15
- (no CPE)range: < 4.14.7-r15
- (no CPE)range: < 4.14.7-r15
- (no CPE)range: < 7.5.7-r34
- (no CPE)range: < 3.8.0-r1
- (no CPE)range: < 23.0.6-r3
- (no CPE)range: < 18.11.11-r2
- (no CPE)range: < 9.4.6-r1
- (no CPE)range: < 24.0.2-r17
- (no CPE)range: < 34.0.3-r2
- (no CPE)range: < 18.7.7-r7
- (no CPE)range: < 3.1.0_git20260901-r1
- Range: <=0.4.1
Patches
Vulnerability mechanics
References
7- github.com/advisories/GHSA-vcc3-ghjq-m6frghsaADVISORY
- nvd.nist.gov/vuln/detail/CVE-2026-45822ghsaADVISORY
- github.com/SamVerschueren/decode-uri-component/blob/00662938dc7c6241547ae8abce7785cc13ffd3f6/index.jsnvdWEB
- github.com/SamVerschueren/decode-uri-component/commit/fa479dafeede7bedf04e5c89aa78f2a78c664005nvdWEB
- github.com/SamVerschueren/decode-uri-component/releases/tag/v0.5.0ghsaWEB
- github.com/SamVerschueren/decode-uri-component/security/advisories/GHSA-vcc3-ghjq-m6frghsaWEB
- www.npmjs.com/package/decode-uri-componentnvdWEB
News mentions
0No linked articles in our index yet.