GHSA-vcc3-ghjq-m6fr: Npm/decode-uri-component vulnerability
Impact An attacker who can supply input to decodeUriComponent() (directly or via a dependency that uses this package on URL/query/path data) can cause excessive CPU usage and application unresponsiveness. This is an availability issue; there is no known memory corruption, data disclosure, or remote code execution impact.
Patches Upgrade to decode-uri-component@0.5.0.
Workarounds Limit the size of the input.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
npm/decode-uri-componentto a version that resolves this vulnerability.Fixed in 0.5.0 - Upgrade
Upgrade
decode-uri-componentto a version that resolves this vulnerability.Fixed in 0.5.0 - Compensating control
Limit the size of the input supplied to decodeUriComponent() (directly or via dependencies) to prevent excessive CPU usage and application unresponsiveness.
Event History
Frequently Asked Questions
Who is exposed to this issue?
Applications are exposed if an attacker can supply data that reaches decodeUriComponent(), either directly or through a dependency that applies it to URL, query-string, or path data.
What is required to exploit the issue?
An attacker needs control over input processed by decodeUriComponent(). Successful exploitation causes excessive CPU use and can make the application unresponsive.
What can be done if upgrading is not immediately possible?
Limit the size of input before it reaches decodeUriComponent(). This reduces the opportunity for oversized attacker-controlled values to trigger excessive CPU usage.
What version contains the fix?
Upgrade decode-uri-component to version 0.5.0.