PatchSiren

SamVerschueren CVE debriefs

These pages are published after PatchSiren validates generated defensive summaries against stored public CVE and source evidence.

HIGH SamVerschueren CVE published 2026-10-29

CVE-2026-118664

A vulnerability in the decode-uri-component package can cause a denial of service via quadratic replacement of percent-encoded runs. A single unauthenticated request of about 224 KB can block the Node.js event loop for about 20 seconds. Version 0.5.0 and prior are affected. The issue was fixed in version 0.5.1. This vulnerability affects Node.js applications using the decode-uri-component package, potenti [truncated]