Vulnerability GHSA-vcc3-ghjq-m6fr
Medium Risk
MEDIUM RISK
CVSS Score: 6.0
Score Range: 4.0–6.9
Medium severity vulnerabilities (CVSS 4.0–6.9). Important issues that meaningfully reduce security confidence.
2 months ago
August 31, 2026 at 10:10 PM UTC
decode-uri-component: Denial of service via exponential decoding of malformed percent-encoded input
0.1.0 - 0.4.1
0.1.0 - 0.4.1
Summary
decode-uri-component: Denial of service via exponential decoding of malformed percent-encoded input
Details
Impact
An attacker who can supply input to decodeUriComponent() (directly or via a dependency that uses this package on URL/query/path data) can cause excessive CPU usage and application unresponsiveness. This is an availability issue; there is no known memory corruption, data disclosure, or remote code execution impact.
Patches
Upgrade to [email protected].
Workarounds
Limit the size of the input.
Related Vulnerabilities
Other vulnerabilities affecting the same packages
High Risk
1 day ago
decode-uri-component vulnerable to denial of service via quadratic replacement of percent-encoded runs
0.1.0 - 0.5.0 GHSA-qr28-fpjm-wq7f
0.1.0 - 0.5.0 GHSA-qr28-fpjm-wq7f
High Risk
3 years ago
decode-uri-component vulnerable to Denial of Service (DoS)
0.1.0 - 0.2.0 GHSA-w573-4hg7-7wgq
0.1.0 - 0.2.0 GHSA-w573-4hg7-7wgq
Impacted packages
Timeline
Published
2 months ago
August 31, 2026 at 10:10 PM UTC
Fixed (0.5.0)
4 months ago
June 29, 2026 at 04:00 PM UTC
Last Modified
1 month ago
September 10, 2026 at 03:51 AM UTC