CVE-2026-118664— decode-uri-component: Denial of service via quadratic replacement of percent-encoded runs
Quick assessment
Affected
SamVerschueren decode-uri-component
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
提供了比 更健壮的替代方案。在 0.5.1 版本之前， 中的 函数会在原生解码抛出异常时回退到自定义的 函数；该回退逻辑会先收集所有不同的百分号编码序列，然后对每个序列执行一次全字符串正则替换。因此，包含大量不同编码序列的畸形输入会导致替换次数与扫描的输入长度同步增长，从而引发二次方级别的 CPU 消耗并阻塞 Node.js 事件循环。请求体中的输入可以达到演示中所示的大小，而普通 URL 头部的长度限制则降低了实际延迟的影响。该问题已在 0.5.1 版本中修复。
Possible ATT&CK Techniques 1 AI
T1499.003 · Application Exhaustion Flood
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-118664
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
decode-uri-component: Denial of service via quadratic replacement of percent-encoded runs
Source: CVE Program / CVE List V5
Vulnerability Description
decode-uri-component provides a more robust alternative to decodeURIComponent. Prior to 0.5.1, decodeUriComponent in index.js falls back to customDecodeURIComponent after native decoding throws, and the fallback collects every distinct percent-encoded run before performing a full-string regular-expression replacement for each entry. Malformed input containing many distinct runs can therefore make both the number of replacements and the scanned input length grow together, causing quadratic CPU consumption and blocking the Node.js event loop; request-body inputs can reach the demonstrated size, while ordinary URL header limits reduce the practical delay. This issue is fixed in version 0.5.1.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Source: CVE Program / CVE List V5
Vulnerability Type
未加控制的资源消耗(资源穷尽)
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| SamVerschueren | decode-uri-component | < 0.5.1 | - |
|
II. Public POCs for CVE-2026-118664
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-118664
请登录查看更多情报信息。
Other References for CVE-2026-118664 (3)
IV. Related Vulnerabilities
Same weakness: CWE-400
-
CVE-2026-118261
Echo: Decompress permits unbounded gzip expansion in v4 -
CVE-2026-118260
Echo: BodyDump captures request and response bodies without -
CVE-2026-118276
a2ui-project a2ui Parser expression_parser.ts formatString r -
CVE-2026-118275
a2ui-project a2ui Resolver data-context.ts DataContext.resol -
CVE-2026-118274
a2ui-project a2ui Binder generic-binder.ts resource consumpt