Read the docs
TI-2026-82205 Aliases CVE-2026-118664GHSA-qr28-fpjm-wq7f

decode-uri-component: Denial of service via quadratic replacement of percent-encoded runs

Priority LOW 36CWE-400Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
Present
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · High
Fix status
Partial Red Hat: 1 fixed, 7 without a fix

Attack profile from CVSS 4.0 · CNA. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-400.

Summary

decode-uri-component provides a more robust alternative to decodeURIComponent. Prior to 0.5.1, decodeUriComponent in index.js falls back to customDecodeURIComponent after native decoding throws, and the fallback collects every distinct percent-encoded run before performing a full-string regular-expression replacement for each entry. Malformed input containing many distinct runs can therefore make both the number of replacements and the scanned input length grow together, causing quadratic CPU consumption and blocking the Node.js event loop; request-body inputs can reach the demonstrated size, while ordinary URL header limits reduce the practical delay. This issue is fixed in version 0.5.1.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00318 24th percentileScored 2026-11-07
Fix Partial decode-uri-component (SamVerschueren): 0.5.1decode-uri-component (npm): 0.5.1Red Hat: 1 advisoryRed Hat: 1 fixed, 7 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
SamVerschuerendecode-uri-componentbefore 0.5.10.5.1Patch availableCNA
—decode-uri-component (npm)before 0.5.10.5.1Patch availableGHSA-qr28-fpjm-wq7f
  • decode-uri-component VendorSamVerschueren Affected before 0.5.1 Fixed in 0.5.1 Patch available CNA
  • decode-uri-component (npm) Vendor— Affected before 0.5.1 Fixed in 0.5.1 Patch available GHSA-qr28-fpjm-wq7f

Remediation

  • Fix · CNA decode-uri-component (SamVerschueren) Fixed in 0.5.1
  • Fix · GHSA-qr28-fpjm-wq7f decode-uri-component (npm) Fixed in 0.5.1 Advisory →

Red Hat 1 advisory

  • RHSA-2026:94580 Released 2026-11-03 · Red Hat rating Important
    Red Hat OpenShift distributed tracing platform (Tempo) 3.11.4 release
    • Red Hat OpenShift distributed tracing 3.11 registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9, registry.redhat.io/rhosdt/tempo-gateway-rhel9, registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9 +2

Vendor assessments

Red Hat

Red Hat rating: Important. Red Hat's page for this CVE →

ProductStatusPlan or fix
OpenShift ServerlessAffectedNo fix yet
Red Hat Ceph Storage 4AffectedNo fix yet
Red Hat OpenShift AI (RHOAI)AffectedNo fix yet
Red Hat OpenShift Container Platform 4AffectedNo fix yet
Red Hat OpenShift Container Platform 5AffectedNo fix yet
Red Hat Quay 3AffectedNo fix yet
Red Hat Satellite 6AffectedNo fix yet
Red Hat OpenShift distributed tracing 3.11Fixed RHSA-2026:94580
Not affected: 10 products
  • Red Hat Ceph Storage 9
  • Red Hat Enterprise Linux 10
  • Red Hat Enterprise Linux 8
  • Red Hat Enterprise Linux 9
  • Red Hat Fuse 7
  • Red Hat Hardened Images
  • Red Hat JBoss Enterprise Application Platform 7
  • Red Hat OpenShift distributed tracing 3.11
  • Red Hat Single Sign-On 7
  • Red Hat build of Apache Camel for Spring Boot 4

Timeline

  1. 2026-10-28 Threatist record created from CVE-2026-118664
  2. 2026-10-29 Alias added: GHSA-qr28-fpjm-wq7f
  3. 2026-10-29 Fix available: npm/[email protected] · GHSA-qr28-fpjm-wq7f
  4. 2026-10-29 CVSS score added · GHSA-qr28-fpjm-wq7f
  5. 2026-10-29 Weakness changed · GHSA-qr28-fpjm-wq7f
  6. 2026-10-29 5 new references · GHSA-qr28-fpjm-wq7f
  7. 2026-10-29 CISA SSVC decision points changed
  8. 2026-10-29 Priority changed: MEDIUM → LOW
  9. 2026-10-30 Affected versions changed · Red Hat
  10. 2026-10-30 CVSS score added · Red Hat
  11. 2026-11-04 Fix available: RHSA-2026:94580 · Red Hat
  12. 2026-11-04 Fix available: Red Hat OpenShift distributed tracing 3.11 · Red Hat

References

Advisory 1

Other 4

  • TI-2026-33553 Uncontrolled resource consumption in SamVerschueren decode-uri-component CVSS 4.0MEDIUM 6.6

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences