# CVE-2022-38900: decode-uri-component denial of service via improper input validation

Source: https://junglewise.ai/threats/cve-2022-38900-decode-uri-component-denial-of-service-via-improper-input  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2022-11-28. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2022-38900 · Severity: low · CVSS 3.1 · Published 2022-11-28

decode-uri-component is a JavaScript library used to safely decode URL-encoded strings in web applications and APIs. A malformed input string can cause the library to crash with a TypeError, making it unavailable to process any requests—a denial of service condition that could disrupt web services relying on this library for URL parsing.

Technologies: [decode-uri-component (npm)](https://junglewise.ai/threats/technologies/npm-decode-uri-component). Vendors: [npm](https://junglewise.ai/threats/vendors/npm).

## Quick answers

**Is CVE-2022-38900 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2022-38900 being exploited in the wild.

**How severe is CVE-2022-38900?** Low severity, with a CVSS score of 3.1, published 28 November 2022.

**Which products and versions are affected?** decode-uri-component (npm) SEMVER:introduced=0,fixed=0.2.1.

**Is there a fix for CVE-2022-38900?** Yes. decode-uri-component (npm): upgrade to 0.2.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2022-38900 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2022-38900?** Check whether you run decode-uri-component (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- decode-uri-component (npm): upgrade to 0.2.1 or later

  ```sh
  npm install decode-uri-component@0.2.1
  ```


## Technical details

decode-uri-component versions prior to 0.2.1 are vulnerable to improper input validation (CWE-20) in URI component decoding. The vulnerability is triggered when malformed percent-encoded sequences (e.g. %ea%ba%5a%ba) are supplied as input, causing the decodeComponents function to return a non-array value. Subsequent code attempts to call .join() on this value, resulting in a TypeError that crashes the application. The vulnerability is triggered by network-reachable input (any URL-encoded string passed to the function), requires no authentication, and allows unauthenticated attackers to trigger denial of service. Patches are available in version 0.2.1 and later.

## Affected products

- Sam Verschueren decode-uri-component 0.2.0 and earlier

## Identifiers

- CVE-2022-38900
- GHSA-w573-4hg7-7wgq

## Timeline

- 2022-11-28: disclosed
- 2022-11-28: patched: Version 0.2.1 released

## References

- [https://github.com/SamVerschueren/decode-uri-component/issues/5](https://github.com/SamVerschueren/decode-uri-component/issues/5)

## Related threats

- [decode-uri-component ReDoS in percent-encoding handling](https://junglewise.ai/threats/cve-2026-118664-decode-uri-component-provides-a-more-robust-alternative-to)
- [SamVerschueren decode-uri-component denial of service in decode function](https://junglewise.ai/threats/cve-2026-45822-samverschueren-decode-uri-component-denial-of-service-in-decode)