Threats affecting pkg:npm/decode-uri-component

CVE-2026-118664 is a high-severity vulnerability in the decode-uri-component library prior to version 0.5.1. The issue arises from the fallback mechanism in decodeUriComponent, which processes malformed percent-encoded input inefficiently, causing quadratic CPU consumption and blocking the Node.js event loop. This can lead to denial of service when processing large or crafted request bodies. The vulnerability is fixed in version 0.5.1.

decode-uri-component through 0.4.1 is vulnerable to denial of service. The decode() function splits input on '%' producing N tokens and calls decodeComponents(), exhibiting super-linear parsing time: 200 '%ab' tokens takes approximately 0.7s, 700 tokens approximately 6s, and 1400 tokens approximately 33s. An attacker can cause significant CPU consumption and event-loop blocking via crafted input.