{"id":"CVE-2026-45822","revision":"7562ed269ce24318b6f2409c3b09295f","records":[{"revision":"7562ed269ce24318b6f2409c3b09295f","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2026-45822","aliases":[],"title":"decode-uri-component through 0.4.1 is vulnerable to denial of service. The decode() function splits input on '%' producing N tokens and calls decodeComponents(), exhibiting super-linear parsing time: 200 '%ab' tokens takes approximately 0.7…","description":"decode-uri-component through 0.4.1 is vulnerable to denial of service. The decode() function splits input on '%' producing N tokens and calls decodeComponents(), exhibiting super-linear parsing time: 200 '%ab' tokens takes approximately 0.7s, 700 tokens approximately 6s, and 1400 tokens approximately 33s. An attacker can cause significant CPU consumption and event-loop blocking via crafted input.","state":0,"publishedAt":"2026-06-30T08:05:36.399+00:00","modifiedAt":"2026-06-30T12:49:30.364+00:00","affected":[{"ecosystem":"Vendor product","name":"decode-uri-component","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"SamVerschueren\",\n                    \"product\": \"decode-uri-component\",\n                    \"platforms\": [\n                        \"Linux\",\n                        \"macOS\",\n                        \"Windows\"\n                    ],\n                    \"versions\": [\n                        {\n                            \"status\": \"affected\",\n                            \"version\": \"0.1.0\",\n                            \"lessThan\": \"0.5.0\",\n                            \"versionType\": \"semver\"\n                        }\n                    ],\n                    \"defaultStatus\": \"unaffected\"\n                }"}],"metrics":[{"system":"CVSS 4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/S:N/AU:Y/R:U/V:D/RE:M/U:Amber","score":6.6,"severity":"MEDIUM"}],"references":["https://github.com/SamVerschueren/decode-uri-component/blob/00662938dc7c6241547ae8abce7785cc13ffd3f6/index.js","https://github.com/SamVerschueren/decode-uri-component/commit/fa479dafeede7bedf04e5c89aa78f2a78c664005","https://www.npmjs.com/package/decode-uri-component"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-45822","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-45822","identifiers":["CVE-2026-45822"]},"retained":false,"historicalAffected":[]}],"coverage":[]}