CVE-2026-45822: Medium severity npm/decode-uri-component vulnerability
Impact An attacker who can supply input to decodeUriComponent() (directly or via a dependency that uses this package on URL/query/path data) can cause excessive CPU usage and application unresponsiveness. This is an availability issue; there is no known memory corruption, data disclosure, or remote code execution impact.
Patches Upgrade to decode-uri-component@0.5.0.
Workarounds Limit the size of the input.
Other sources
decode-uri-component through 0.4.1 is vulnerable to denial of service. The decode() function splits input on '%' producing N tokens and calls decodeComponents(), exhibiting super-linear parsing time: 200 '%ab' tokens takes approximately 0.7s, 700 tokens approximately 6s, and 1400 tokens approximately 33s. An attacker can cause significant CPU consumption and event-loop blocking via crafted input.
— NVD
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
npm/decode-uri-componentto a version that resolves this vulnerability.Fixed in 0.5.0 - Upgrade
Upgrade
decode-uri-componentto a version that resolves this vulnerability.Fixed in 0.5.0 - Compensating control
Limit the size of the input passed to decodeUriComponent()/decode() to reduce excessive CPU usage and event-loop blocking (decode splits on '%' and shows super-linear parsing time as token count increases).
Event History
Frequently Asked Questions
What is the severity of CVE-2026-45822?
CVE-2026-45822 has a medium severity rating of 6.6 according to the CVSS scoring system.
What type of vulnerability is identified in CVE-2026-45822?
CVE-2026-45822 is a denial of service vulnerability affecting the decode-uri-component library.
How does CVE-2026-45822 affect performance?
CVE-2026-45822 can lead to super-linear parsing time, causing performance degradation with larger input.
Which software is affected by CVE-2026-45822?
The vulnerability CVE-2026-45822 affects the decode-uri-component library, specifically version 0.4.1.
How can I fix CVE-2026-45822?
To mitigate CVE-2026-45822, upgrade to the latest version of the decode-uri-component library where the issue is resolved.