decode-uri-component vulnerabilities

CVEs whose affected-version data names the decode-uri-component package (npm). Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.

1 CVERSS

CVE-2026-118664High· 8.2

5d ago

decode-uri-component: Denial of service via quadratic replacement of percent-encoded runs

decode-uri-component provides a more robust alternative to decodeURIComponent. Prior to 0.5.1, decodeUriComponent in index.js falls back to customDecodeURIComponent after native decoding throws, and the fallback collects every distinct p…

▾ TwilightSamVerschueren · decode-uri-componentEPSS 0.32%via CVEORG