Executive brief
decode-uri-component is a JavaScript library used to safely decode URL-encoded strings in web applications and APIs. A malformed input string can cause the library to crash with a TypeError, making it unavailable to process any requests—a denial of service condition that could disrupt web services relying on this library for URL parsing.
Technical details
decode-uri-component versions prior to 0.2.1 are vulnerable to improper input validation (CWE-20) in URI component decoding. The vulnerability is triggered when malformed percent-encoded sequences (e.g. %ea%ba%5a%ba) are supplied as input, causing the decodeComponents function to return a non-array value. Subsequent code attempts to call .join() on this value, resulting in a TypeError that crashes the application. The vulnerability is triggered by network-reachable input (any URL-encoded string passed to the function), requires no authentication, and allows unauthenticated attackers to trigger denial of service. Patches are available in version 0.2.1 and later.
Affected products
- Sam Verschueren decode-uri-component 0.2.0 and earlier
Timeline
- 2022-11-28: disclosed
- 2022-11-28: patched: Version 0.2.1 released