GHSA-vcc3-ghjq-m6fr

Suggest an improvement
Source
https://github.com/advisories/GHSA-vcc3-ghjq-m6fr
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/08/GHSA-vcc3-ghjq-m6fr/GHSA-vcc3-ghjq-m6fr.json
JSON Data
https://api.osv.dev/v1/vulns/GHSA-vcc3-ghjq-m6fr
Aliases
Downstream
Published
2026-08-31T22:10:20Z
Modified
2026-09-10T03:51:14Z
Severity
  • 6.6 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/S:N/AU:Y/R:U/V:D/RE:M/U:Amber CVSS Calculator
Summary
decode-uri-component: Denial of service via exponential decoding of malformed percent-encoded input
Details

Impact

An attacker who can supply input to decodeUriComponent() (directly or via a dependency that uses this package on URL/query/path data) can cause excessive CPU usage and application unresponsiveness. This is an availability issue; there is no known memory corruption, data disclosure, or remote code execution impact.

Patches

Upgrade to decode-uri-component@0.5.0.

Workarounds

Limit the size of the input.

Database specific 
{
    "cwe_ids": [
        "CWE-1176",
        "CWE-400",
        "CWE-405",
        "CWE-407"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-08-31T22:10:20Z",
    "nvd_published_at": "2026-06-30T09:16:25Z",
    "severity": "MODERATE"
}
References

Affected packages

npm / decode-uri-component

Package

Name
decode-uri-component
View open source insights on deps.dev
Purl
pkg:npm/decode-uri-component

Affected ranges

Type
SEMVER
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
0.5.0

Database specific

last_known_affected_version_range 
"<= 0.4.2"
source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/08/GHSA-vcc3-ghjq-m6fr/GHSA-vcc3-ghjq-m6fr.json"