Summary
decode-uri-component vulnerable to denial of service via quadratic replacement of percent-encoded runs
decodeUriComponent() takes quadratic time on malformed input that has many distinct percent-encoded runs. A single unauthenticated request of about 224 KB can block the Node.js event loop for about 20 seconds. Version 0.5.0, the release that fixed CVE-2026-45822, is affected.
Details
When native decodeURIComponent throws, decodeUriComponent() falls back to customDecodeURIComponent (index.js:122). That function:
- Scans the input for every run of percent-encoded bytes (e.g.
%C3%A5) and stores each distinct run, with its decoded value, in a lookup table (index.js:130-144). - Runs one full-string
input.replace(new RegExp(key, 'g'), …)per table entry (index.js:154).
With K distinct runs in an input of length L, that's K regex compilations and K full scans of the string, so O(K·L). An attacker controls both K and L, and K grows with L. One malformed sequence such as a trailing %zz is enough to force the fallback path.
The 0.5.0 fix for CVE-2026-45822 (fa479da) replaced the recursive decode() routine with a linear scanner, but left this replacement loop unchanged.
Proof of concept
Running the following code takes ~20 seconds.
import decodeUriComponent from 'decode-uri-component';
let payload = '';
for (let i = 0; i < 32000; i++) {
const high = Math.floor(i / 256).toString(16).padStart(2, '0');
const low = (i % 256).toString(16).padStart(2, '0');
payload += `%${high}%${low}x`; // distinct run each iteration
}
payload += '%zz'; // forces the fallback decoder
console.time('decode');
decodeUriComponent(payload); // ~224 KB
console.timeEnd('decode');
Impact
This is an availability issue only and there's no confidentiality or integrity impact. Any application that passes untrusted input to decodeUriComponent(), directly or through a dependency such as query-string, can be made unresponsive. Because Node.js runs on one thread, one request stalls every other client.
The worst case needs input well beyond URL length limits. Node's default 16 KB header limit keeps payloads passed in via a URL query string to roughly 40 ms per request. Applications that decode request bodies are fully exposed, for example form bodies parsed with query-string.parse().
Crafted input forces the application to consume excessive CPU, memory, or other resources, degrading or denying service. Typical impact: denial of service.
Affected versions
Security releases
Kodem intelligence
Severity tells you how bad this could be in the worst case. It does not tell you whether you are exposed. Exploitability and impact are functions of runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A vulnerable package can sit in your dependency tree and never run.
Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter. Kodem's runtime-powered SCA identifies whether this CVE is reachable in your applications.
Already deployed Kodem?
See it in your environmentNew to Kodem? Get a demo →Remediation advice
Kodem Kai can prioritize this vulnerability in your dependency tree and generate a fix recommendation.
Frequently Asked Questions
- What is CVE-2026-118664? CVE-2026-118664 is a high-severity uncontrolled resource consumption vulnerability in decode-uri-component (npm), affecting versions <= 0.5.0. It is fixed in 0.5.1. Crafted input forces the application to consume excessive CPU, memory, or other resources, degrading or denying service.
- Which versions of decode-uri-component are affected by CVE-2026-118664? decode-uri-component (npm) versions <= 0.5.0 is affected.
- Is there a fix for CVE-2026-118664? Yes. CVE-2026-118664 is fixed in 0.5.1. Upgrade to this version or later.
- Is CVE-2026-118664 exploitable, and should I be worried? Whether CVE-2026-118664 is exploitable in your environment depends on whether the vulnerable code is present and reachable. A CVSS score is a worst-case rating; it does not account for your specific deployment, configuration, or usage patterns. Kodem, an Intelligent Application Security platform, uses runtime intelligence to show which vulnerabilities actually execute in production, so you can focus on the ones that represent real risk. Get a demo
- What actually determines whether CVE-2026-118664 is exploitable, and how bad it is? Exploitability and impact are not fixed properties of a CVE. They depend on runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A high CVSS score on a dependency that never runs is not the same as real risk. Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter.
- How do I fix CVE-2026-118664? Upgrade
decode-uri-componentto 0.5.1 or later.