AZL-111706

See a problem?
Import Source
https://github.com/microsoft/AzureLinuxVulnerabilityData/blob/main/osv/AZL-111706.json
JSON Data
https://api.osv.dev/v1/vulns/AZL-111706
Upstream
Published
2026-10-28T21:16:56Z
Modified
2026-11-02T05:30:44Z
Summary
CVE-2026-118664 affecting package js-jquery 3.5.0-4
Details

decode-uri-component provides a more robust alternative to decodeURIComponent. Prior to 0.5.1, decodeUriComponent in index.js falls back to customDecodeURIComponent after native decoding throws, and the fallback collects every distinct percent-encoded run before performing a full-string regular-expression replacement for each entry. Malformed input containing many distinct runs can therefore make both the number of replacements and the scanned input length grow together, causing quadratic CPU consumption and blocking the Node.js event loop; request-body inputs can reach the demonstrated size, while ordinary URL header limits reduce the practical delay. This issue is fixed in version 0.5.1.

References

Affected packages

Azure Linux:3 / js-jquery

Package

Name
js-jquery
Purl
pkg:rpm/azure-linux/js-jquery

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Last Affected
3.5.0-4

Database specific

source
"https://github.com/microsoft/AzureLinuxVulnerabilityData/blob/main/osv/AZL-111706.json"