CVE-2026-118664 SamVerschueren CVE debrief

Who should care

Defenders and developers using the decode-uri-component package in their applications should verify exposure and apply the patch to prevent potential denial of service issues. This includes reviewing the current version of the package, assessing the potential impact on Node.js applications, and implementing necessary updates or mitigations. Additionally, defenders should monitor performance and potential denial of service issues, and review compensating.

Why it matters

The vulnerability in decode-uri-component can cause denial of service via quadratic replacement of percent-encoded runs, affecting Node.js applications. Defenders should verify exposure and apply the patch to prevent potential issues.

• Denial of service via performance degradation
• Potential event loop blocking in Node.js
• Increased risk of application unavailability

Technical summary

The customDecodeURIComponent function in the decode-uri-component package takes quadratic time on malformed input with many distinct percent-encoded runs, leading to performance issues and potential denial of service. This occurs when the function falls back to customDecodeURIComponent due to native decodeURIComponent throwing, causing a time complexity of O(K·L) where K is the number of distinct runs and L is the input length. An attacker controls both K and L, allowing for a potential denial of service via quadratic replacement of percent-encoded runs.

Defensive priority

Defenders should prioritize verifying exposure and applying the patch, as the vulnerability can cause performance issues and potential denial of service.

Recommended defensive actions

• Verify if the decode-uri-component package is used in the application
• Check if the version is 0.5.0 or prior
• Apply the patch by updating to version 0.5.1 or later
• Monitor performance and potential denial of service issues
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.

Evidence notes

The vulnerability is caused by the customDecodeURIComponent function in the decode-uri-component package, which takes quadratic time on malformed input with many distinct percent-encoded runs. This can lead to performance issues and potential denial of service.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.