HighVulnerabilityCVE-2026-118664updated 29 Oct 2026, 16:41 UTC

decode-uri-component can freeze Node.js servers on crafted input

A small library that decodes web addresses can be tricked into taking a very long time on specially crafted text. While it works, the whole Node.js server stops answering other visitors.

Fixed in 0.5.1Official, 2 sources

Severity	HighCVSS 8.2 of 10
Being exploited?	UnclearNo reports either way yet
Fix available?	Yes0.5.1 · since 29 Oct 2026
How sure is this?	Official, 2 sourcesBacked by an official source

How the attack works simplified

1Attacker sends payloadOne unauthenticated request of about 224 KB
2Request reaches serverBody or query is passed to the decoder
3Native decode throwsMalformed input forces the fallback path
4Quadratic replacement loopMany full-string regex scans block the event loop
ResultServer stops responding to all clients

What happened

npm package decode-uri-component up to 0.5.0 has a quadratic-time fallback in decodeUriComponent() when native decoding throws on malformed input with many distinct percent-encoded runs, blocking the Node.js event loop (denial of service).

Why it is dangerous: An unauthenticated attacker can send one request of roughly 224 KB and block the Node.js event loop for about 20 seconds, stalling all other clients. Applications that decode request bodies, such as form bodies parsed with query-string, are fully exposed; URL query inputs are limited to roughly 40 ms per request by header limits.

Are you affected?

You are affected if your app uses decode-uri-component 0.5.0 or earlier (directly or via a dependency such as query-string) and passes untrusted input to decodeUriComponent(), especially request bodies.

Package / product	Affected versions	Fixed in
decode-uri-component · npm	<= 0.5.0	0.5.1

What to do

Update decode-uri-component to 0.5.1 or later
Check your dependency tree (for example query-string) for transitive copies and update them too
Rebuild and redeploy the application after updating

Timeline

28 Oct 2026, 21:16 UTC
Publicly disclosed
28 Oct 2026, 21:16 UTC
Reported by NVD · NVD
28 Oct 2026, 21:18 UTC
Picked up by Zero Radar
29 Oct 2026, 16:41 UTC
GitHub Advisory reported on it · GitHub Advisory
29 Oct 2026, 16:41 UTC
Fixed version published: decode-uri-component 0.5.1 · GitHub Advisory

Sources 2 reports, oldest first

Official vendor, government CERT or advisory database

CVE-2026-118664NVD · 28 Oct 2026, 21:16 UTC
decode-uri-component vulnerable to denial of service via quadratic replacement of percent-encoded runsGitHub Advisory · 29 Oct 2026, 16:41 UTC

Technical details

ID: CVE-2026-118664 · GHSA-qr28-fpjm-wq7f
CVSS: 8.2 / 10
Disclosed: 28 Oct 2026, 21:16 UTC
On Zero Radar: 28 Oct 2026, 21:18 UTC (1 min after disclosure)
Last change: 29 Oct 2026, 16:41 UTC

The plain-language parts and the attack diagram were written by an AI model (anthropic/claude-haiku-5.5) from the sources above. Facts like versions, exploitation and dates come from the sources themselves. How Zero Radar works