Copyright © 2012 Red Hat, Inc. All rights reserved. Important 2026-06-30T08:05:36 decode-uri-component: decode-uri-component: Denial of Service via crafted input 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CWE-1050

decode-uri-component through 0.4.1 is vulnerable to denial of service. The decode() function splits input on '%' producing N tokens and calls decodeComponents(), exhibiting super-linear parsing time: 200 '%ab' tokens takes approximately 0.7s, 700 tokens approximately 6s, and 1400 tokens approximately 33s. An attacker can cause significant CPU consumption and event-loop blocking via crafted input.

A flaw was found in the `decode-uri-component` library. This vulnerability allows a remote attacker to trigger a Denial of Service (DoS) by submitting specially crafted input. The `decode()` function, when processing a large number of encoded URI components, consumes excessive CPU resources, which can lead to the application becoming unresponsive and unavailable.

A denial of service flaw was found in the decode-uri-component npm package. The decode() function exhibits super-linear time complexity when processing input containing many percent-encoded sequences, allowing an attacker to cause significant CPU consumption and event-loop blocking. In Red Hat products where this package is bundled (OpenShift Console, Quay, Pipelines, RHOAI, and others), exploitation requires that attacker-controlled input containing crafted percent-encoded strings reaches the decode() function without prior length validation. Red Hat rates this as Moderate severity since the impact is limited to availability with no confidentiality or integrity impact, consistent with the CNA's CVSS 4.0 assessment of 6.6 Medium. Validate and limit the length of any user-controlled input before passing it to decode-uri-component's decode() function. Inputs containing more than approximately 200 percent-encoded tokens (e.g. '%ab' sequences) can trigger noticeable delays. Reject or truncate URI components exceeding a reasonable length threshold before decoding. A fix exists in the upstream repository (commit fa479daf) but has not yet been included in an npm release. Red Hat Quay 3.10 2026-07-16T00:00:00Z RHSA-2026:41031 quay/quay-rhel8:1783750447 Red Hat Quay 3.16 2026-07-16T00:00:00Z RHSA-2026:41066 quay/quay-rhel9:1783955846 Red Hat Quay 3.9 2026-07-15T00:00:00Z RHSA-2026:40262 quay/quay-rhel8:1784125838 Migration Toolkit for Containers Affected rhmtc/openshift-migration-ui-rhel8 OpenShift Pipelines Affected openshift-pipelines/pipelines-console-plugin-pf5-rhel9 OpenShift Pipelines Affected openshift-pipelines/pipelines-console-plugin-rhel9 Red Hat 3scale API Management Platform 2 Not affected 3scale-amp21/system Red Hat 3scale API Management Platform 2 Not affected 3scale-amp22/system Red Hat 3scale API Management Platform 2 Not affected 3scale-amp2/system-rhel7 Red Hat 3scale API Management Platform 2 Affected 3scale-amp2/system-rhel8 Red Hat 3scale API Management Platform 2 Not affected 3scale-amp2/system-rhel9 Red Hat build of Apache Camel for Spring Boot 4 Not affected decode-uri-component Red Hat Enterprise Linux 8 Not affected grafana Red Hat Enterprise Linux 8 Not affected pcs Red Hat Enterprise Linux 9 Not affected gjs Red Hat Enterprise Linux 9 Not affected pcs Red Hat Hardened Images Affected dotnet8.0 Red Hat Hardened Images Not affected yarnpkg Red Hat JBoss Enterprise Application Platform 7 Affected decode-uri-component Red Hat JBoss Enterprise Application Platform Expansion Pack Affected decode-uri-component Red Hat OpenShift AI (RHOAI) Not affected rhoai/odh-mlflow-rhel9 Red Hat OpenShift Container Platform 4 Affected openshift4/ose-console Red Hat OpenShift Container Platform 4 Affected openshift4/ose-console-rhel9 Red Hat OpenShift distributed tracing 3 Affected rhosdt/tempo-jaeger-query-rhel9 Red Hat Satellite 6 Affected satellite/iop-vulnerability-frontend-rhel9 https://www.cve.org/CVERecord?id=CVE-2026-45822 https://nvd.nist.gov/vuln/detail/CVE-2026-45822 https://github.com/SamVerschueren/decode-uri-component/blob/00662938dc7c6241547ae8abce7785cc13ffd3f6/index.js https://github.com/SamVerschueren/decode-uri-component/commit/fa479dafeede7bedf04e5c89aa78f2a78c664005 https://www.npmjs.com/package/decode-uri-component