Skip to content
Fencer Vulns
medium 6.6

CVE-2026-45822 json

decode-uri-component: Denial of service via exponential decoding of malformed percent-encoded input

published 2026-06-30 4 mo ago modified 2026-10-25 14 d ago also GHSA-vcc3-ghjq-m6fr , EUVD-2026-40267

cvss
6.6
version 4.0, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.5%
EPSS 0.5% chance of exploitation in 30 days, percentile 43%
public exploits
0
none known

Summary

decode-uri-component through 0.4.1 is vulnerable to denial of service. The decode() function splits input on '%' producing N tokens and calls decodeComponents(), exhibiting super-linear parsing time: 200 '%ab' tokens takes approximately 0.7s, 700 tokens approximately 6s, and 1400 tokens approximately 33s. An attacker can cause significant CPU consumption and event-loop blocking via crafted input.

Patch / fix

  • npm decode-uri-component 0.5.0
  • SamVerschueren decode-uri-component 0.5.0

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2026-45822 updated cvss 7.5

decode-uri-component: decode-uri-component: Denial of Service via crafted input

  • Red Hat OpenShift Pipelines openshift-pipelines/pipelines-console-plugin-rhel9, openshift-pipelines/pipelines-console-plugin-pf5-rhel9 Red Hat 3scale API Management Platform 2 3scale-amp2/system-rhel8 Red Hat OpenShift Container Platform 5 openshift5/ose-console-rhel9 Red Hat OpenShift distributed tracing 3 rhosdt/tempo-jaeger-query-rhel9
    affected: workaround, no fix available
  • Red Hat Migration Toolkit 1.8 rhmtc/openshift-migration-ui-rhel8 1783690532
    fixed: vendor fix RHSA-2026:41928
  • Red Hat Quay 3.9 quay/quay-rhel8 1784125838
    fixed: vendor fix RHSA-2026:40262
  • Red Hat Quay 3.10 quay/quay-rhel8 1783750447
    fixed: vendor fix RHSA-2026:41031
  • Red Hat Quay 3.12 quay/quay-rhel8 1783751865, quay/quay-rhel8 1784353904
    fixed: vendor fix RHSA-2026:42146
  • Red Hat Quay 3.15 quay/quay-rhel8 1785261506
    fixed: vendor fix RHSA-2026:48933
  • Red Hat Quay 3.16 quay/quay-rhel9 1783955846
    fixed: vendor fix RHSA-2026:41066
  • Red Hat Satellite 6.18 satellite/iop-vulnerability-frontend-rhel9 1785762027
    fixed: vendor fix RHSA-2026:51348
show 8 more
  • Red Hat Satellite 6.19 satellite/iop-vulnerability-frontend-rhel9 1785937325
    fixed: vendor fix RHSA-2026:51197
  • Red Hat 3scale API Management Platform 2 3scale-amp21/system, 3scale-amp22/system, 3scale-amp2/system-rhel7, 3scale-amp2/system-rhel9 Red Hat build of Apache Camel for Spring Boot 4 decode-uri-component
    not affected: component not present
  • Red Hat Enterprise Linux 8 pcs, grafana, pcs-snmp, grafana-loki, grafana-mssql, grafana-mysql, +10 more Red Hat Enterprise Linux 9 gjs, pcs, pcs-snmp Red Hat Hardened Images yarnpkg, dotnet8.0 8.0.128-1.hum1
    not affected: vulnerable code not present
  • Red Hat JBoss Enterprise Application Platform 7 decode-uri-component Red Hat JBoss Enterprise Application Platform Expansion Pack decode-uri-component
    not affected: component not present
  • Red Hat Migration Toolkit 1.8 rhmtc/openshift-migration-openvpn-rhel8 1783914237, rhmtc/openshift-migration-registry-rhel8 1783914276, rhmtc/openshift-migration-rhel8-operator 1783969382, rhmtc/openshift-migration-operator-bundle 1783969793, rhmtc/openshift-migration-controller-rhel8 1783953372, rhmtc/openshift-migration-log-reader-rhel8 1783914253, +4 more
    not affected: vulnerable code not present
  • Red Hat OpenShift AI (RHOAI) rhoai/odh-mlflow-rhel9
    not affected: component not present
  • Red Hat OpenShift Container Platform 4 openshift4/ose-console, openshift4/ose-console-rhel9
    not affected: vulnerable code not in execute path
  • Red Hat Quay 3.9 quay/clair-rhel8 1783747905, quay/quay-builder-rhel8 1783747952, quay/quay-operator-rhel8 1783748131, quay/quay-operator-bundle 1784129592, quay/quay-bridge-operator-rhel8 1783748068, quay/quay-bridge-operator-bundle 1783749906, +3 more Red Hat Quay 3.10 quay/clair-rhel8 1783749793, quay/quay-builder-rhel8 1783750044, quay/quay-operator-rhel8 1783750939, quay/quay-operator-bundle 1783754116, quay/quay-bridge-operator-rhel8 1783749646, quay/quay-bridge-operator-bundle 1783750752, +3 more Red Hat Quay 3.12 quay/clair-rhel8 1783750391, quay/clair-rhel8 1784353287, quay/quay-builder-rhel8 1783750888, quay/quay-builder-rhel8 1784353436, quay/quay-operator-rhel8 1783751561, quay/quay-operator-rhel8 1784354521, +12 more Red Hat Quay 3.15 quay/clair-rhel8 1785177181, quay/quay-builder-rhel8 1785180550, quay/quay-operator-rhel8 1785177009, quay/quay-operator-bundle 1785322285, quay/quay-bridge-operator-rhel8 1785177338, quay/quay-bridge-operator-bundle 1785274696, +3 more Red Hat Quay 3.16 quay/clair-rhel9 1783749100, quay/quay-builder-rhel9 1783748231, quay/quay-operator-rhel9 1783748063, quay/quay-operator-bundle 1783961339, quay/quay-bridge-operator-rhel9 1783748414, quay/quay-bridge-operator-bundle 1783749615, +3 more
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
none
Automatable
yes
Technical impact
partial
Assessed
4 mo ago

Exploit prediction

0.51% chance of exploitation in the next 30 days, higher than 43% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CNA 4.0 6.6 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/S:N/AU:Y/R:U/V:D/RE:M/U:Amber
CNA 4.0 6.6 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:N/AU:Y/R:U/V:D/RE:M/U:Amber

Affected packages

ecosystem package affected fixed in
npm decode-uri-component
<0.5.0
0.5.0

Affected products

  • SamVerschueren decode-uri-component

Classification

Weakness
  • CWE-400 Uncontrolled Resource Consumption
  • CWE-407 Inefficient Algorithmic Complexity
  • CWE-1176 Inefficient CPU Computation
  • CWE-405 Asymmetric Resource Consumption (Amplification)

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.