decode-uri-component
npm3 known CVEs affecting this package
Aggregated from OSV, GitHub Security Advisories, NVD, and vendor advisories. Each CVE links to its full detail page with vendor advisories, patches, fixed versions, and remediation guidance.
CVEs affecting decode-uri-componentpage 1 of 1
- CVE-2022-38900HIGHCVSS 7.5EG 7.5fixed in 0.2.12022-11-28
decode-uri-component 0.2.0 is vulnerable to Improper Input Validation resulting in DoS.
- CVE-2026-118664HIGHCVSS 8.2EG 8.2fixed in 0.5.12026-10-28
decode-uri-component provides a more robust alternative to decodeURIComponent. Prior to 0.5.1, decodeUriComponent in index.js falls back to customDecodeURIComponent after native decoding throws, and the fallback collects every distinct per…
- CVE-2026-45822MEDIUMCVSS 6.6EG 6.6fixed in 0.5.02026-06-30
decode-uri-component through 0.4.1 is vulnerable to denial of service. The decode() function splits input on '%' producing N tokens and calls decodeComponents(), exhibiting super-linear parsing time: 200 '%ab' tokens takes approximately 0.…
Check whether decode-uri-component is used in your infrastructure
EchelonGraph scans your cloud and SBOMs to map every package to your actual deployments. See blast radius for decode-uri-component CVEs against the assets you own.
Book a Demo →