REDHAT-BUG-2494807: High severity npm/decode-uri-component vulnerability

Q: What input is required to trigger the denial of service?

An attacker needs to supply crafted input containing many percent-encoded token sequences, such as repeated "%ab" values, to the package's decode() function.

Q: What is the operational impact of exploitation?

Processing the crafted input can consume significant CPU time and block the event loop. Reported parsing times rise from about 0.7 seconds for 200 "%ab" tokens to about 33 seconds for 1,400 tokens.

Q: Which package versions are affected?

The issue affects decode-uri-component through version 0.4.1.

Published Jun 30, 2026

Updated

decode-uri-component through 0.4.1 is vulnerable to denial of service. The decode() function splits input on '%' producing N tokens and calls decodeComponents(), exhibiting super-linear parsing time: 200 '%ab' tokens takes approximately 0.7s, 700 tokens approximately 6s, and 1400 tokens approximately 33s. An attacker can cause significant CPU consumption and event-loop blocking via crafted input.

Affected Software

1 affected component

npm/decode-uri-component<=0.4.1

Event History

Jun 30, 2026

Data Sourced

via Red Hat·09:01 AM

DescriptionSeverityAffected Software

Frequently Asked Questions

What input is required to trigger the denial of service?

An attacker needs to supply crafted input containing many percent-encoded token sequences, such as repeated "%ab" values, to the package's decode() function.

What is the operational impact of exploitation?

Processing the crafted input can consume significant CPU time and block the event loop. Reported parsing times rise from about 0.7 seconds for 200 "%ab" tokens to about 33 seconds for 1,400 tokens.

Which package versions are affected?

The issue affects decode-uri-component through version 0.4.1.