decode-uri-component vulnerable to denial of service via quadratic replacement of percent-encoded runs

Summary decodeUriComponent() takes quadratic time on malformed input that has many distinct percent-encoded runs. A single unauthenticated request of about 224 KB can block the Node.js event loop for about 20 seconds. Version 0.5.0, the release that fixed CVE-2026-45822, is affected. Details When native decodeURIComponent throws, decodeUriComponent() falls back to customDecodeURIComponent (index.js:122). That function: 1. Scans the input for every run of percent-encoded bytes (e.g. %C3%A5) and stores each distinct run, with its decoded value, in a lookup table (index.js:130-144). 2. Runs one full-string input.replace(new RegExp(key, 'g'), …) per table entry (index.js:154). With K distinct runs in an input of length L, that's K regex compilations and K full scans of the string, so O(K·L). An attacker controls both K and L, and K grows with L. One malformed sequence such as a trailing %zz is enough to force the fallback path. The 0.5.0 fix for CVE-2026-45822 (fa479da) replaced the recursive decode() routine with a linear scanner, but left this replacement loop unchanged. Proof of concept Running the following code takes ~20 seconds. js import decodeUriComponent from…

curl https://cve.zerocrew.in/api/cve/CVE-2026-118664