GHSA-qr28-fpjm-wq7fPublished
decode-uri-component: Denial of service via quadratic replacement of percent-encoded runs
Explicit identifiers and source references
These records connect through source-stated identifiers. Shared identifiers or dates alone do not establish shared exposure, root cause or applicability.
CVE-2026-118664 · Microsoft / collected KEV context
cve-program · CVE-2026-118664
- https://github.com/SamVerschueren/decode-uri-component/security/advisories/GHSA-qr28-fpjm-wq7f
- https://github.com/SamVerschueren/decode-uri-component/commit/fad01d65b93bd3f2f0dc32dfd8d57a38b57bc608
- https://github.com/SamVerschueren/decode-uri-component/releases/tag/v0.5.1
euvd · EUVD-2026-112471
- https://github.com/SamVerschueren/decode-uri-component/security/advisories/GHSA-qr28-fpjm-wq7f
- https://github.com/SamVerschueren/decode-uri-component/commit/fad01d65b93bd3f2f0dc32dfd8d57a38b57bc608
- https://github.com/SamVerschueren/decode-uri-component/releases/tag/v0.5.1
nvd · CVE-2026-118664
- https://github.com/SamVerschueren/decode-uri-component/commit/fad01d65b93bd3f2f0dc32dfd8d57a38b57bc608
- https://github.com/SamVerschueren/decode-uri-component/releases/tag/v0.5.1
- https://github.com/SamVerschueren/decode-uri-component/security/advisories/GHSA-qr28-fpjm-wq7f
osv · GHSA-qr28-fpjm-wq7f
- https://github.com/SamVerschueren/decode-uri-component/security/advisories/GHSA-qr28-fpjm-wq7f
- https://nvd.nist.gov/vuln/detail/CVE-2026-118664
- https://github.com/SamVerschueren/decode-uri-component/commit/fad01d65b93bd3f2f0dc32dfd8d57a38b57bc608
- https://github.com/SamVerschueren/decode-uri-component
- https://github.com/SamVerschueren/decode-uri-component/releases/tag/v0.5.1
Related operational evidence
Explicit CVE identifiers- decode-uri-component provides a more robust alternative to decodeURIComponent. Prior to 0.5.1, decodeUriComponent in index.js falls back to customDecodeURIComponent after native decoding throws, and the fallback collects every distinct perc… · Advisory content revised · 6 Nov 2026
- decode-uri-component vulnerable to denial of service via quadratic replacement of percent-encoded runs · Newly collected advisory · 29 Oct 2026
- decode-uri-component: Denial of service via quadratic replacement of percent-encoded runs · Newly collected advisory · 28 Oct 2026