CVE-2026-45822: Algorithmic Complexity Denial of Service in decode-uri-component
Vulnerability ID: CVE-2026-45822
CVSS Score: 6.6
Published: 2026-08-31
A critical algorithmic complexity Denial of Service (DoS) vulnerability exists in the npm package decode-uri-component versions 0.1.0 through 0.4.1. The package employs an inefficient, high-complexity recursive mechanism when processing invalid percent-encoded sequences, such as isolated continuation bytes. An attacker can exploit this behavior by sending malformed strings, causing the Node.js event loop to block entirely and exhausting CPU resources. This vulnerability is resolved in version 0.5.0 by replacing the recursive parser with a single-pass, linear scanning algorithm.
TL;DR
The decode-uri-component package (versions 0.1.0 to 0.4.1) contains an algorithmic complexity vulnerability that enables unauthenticated remote attackers to block the single-threaded Node.js event loop and cause a complete Denial of Service via crafted malformed URI payloads.
⚠️ Exploit Status: POC
Technical Details
- CWE ID: CWE-407 (Inefficient Algorithmic Complexity)
- Attack Vector: Network (Remote, Unauthenticated)
- CVSS v4.0 Score: 6.6
- EPSS Score: 0.00507 (41.20th percentile)
- Impact: Denial of Service (Node.js Event Loop Freeze)
- Exploit Status: Proof-of-Concept Available
- KEV Status: Not Listed
Affected Systems
- Node.js applications running decode-uri-component < 0.5.0
- Direct and indirect npm dependency trees inheriting vulnerable decode-uri-component versions
-
decode-uri-component: >= 0.1.0, <= 0.4.1 (Fixed in:
0.5.0)
Code Analysis
Commit: fa479da
Replace recursive fallback with a single-pass linear O(n) scanning algorithm to fix CVE-2026-45822
Exploit Details
- GitHub Vulnerability Advisory: Repository commit detailing fix and containing unit tests reproducing the malformed payload behavior
Mitigation Strategies
- Upgrade to version 0.5.0 or above
- Use dependency overrides/resolutions to force upgrade transit dependencies
- Deploy WAF rules to drop requests containing extremely long chains of malformed percent-encoded sequences
Remediation Steps:
- Run 'npm ls decode-uri-component' to identify occurrences
- Update the direct dependency in package.json to ^0.5.0
- Add overrides or resolutions block to package.json for transit dependency forcing
- Execute 'npm update' or 'yarn install' to rebuild the lockfile
References
- Official NVD Registry Entry
- CVE.org Record
- Wiz Vulnerability Database entry
- Fix Commit (SamVerschueren/decode-uri-component)
- Original Vulnerable Source Entry
- NPM Registry Resource
- CVE V5 Reference JSON
Read the full report for CVE-2026-45822 on our website for more details including interactive diagrams and full exploit analysis.
Top comments (0)