# CVE-2022-41777: nadesiko3 Denial of Service in decodeURIComponent handling

Source: https://junglewise.ai/threats/cve-2022-41777-nadesiko3-denial-of-service-in-decodeuricomponent-handling  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2022-12-05. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2022-41777 · Severity: low · CVSS 3 · Published 2022-12-05

Nadesiko3 is a programming language environment with an editor component (nako3edit). A remote attacker can send specially crafted input that triggers improper exception handling in the URI decoder, causing the server to crash. This creates a denial of service vulnerability affecting availability of systems running affected versions.

Technologies: [nadesiko3 (npm)](https://junglewise.ai/threats/technologies/nadesiko3). Vendors: [npm](https://junglewise.ai/threats/vendors/npm).

## Quick answers

**Is CVE-2022-41777 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2022-41777 being exploited in the wild.

**How severe is CVE-2022-41777?** Low severity, with a CVSS score of 3, published 5 December 2022.

**Which products and versions are affected?** nadesiko3 (npm) SEMVER:introduced=0,fixed=3.3.75.

**Is there a fix for CVE-2022-41777?** Yes. nadesiko3 (npm): upgrade to 3.3.75 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2022-41777 attacked?** It is attacked over the network.

**Am I affected by CVE-2022-41777?** Check whether you run nadesiko3 (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- nadesiko3 (npm): upgrade to 3.3.75 or later

  ```sh
  npm install nadesiko3@3.3.75
  ```


## Technical details

Nako3edit in nadesiko3 v3.3.74 and earlier contains improper exception handling (CWE-703, CWE-755) in the decodeURIComponent function. An unauthenticated remote attacker can send invalid URI-encoded values over the network without any special privileges, causing an uncaught exception that crashes the server. The vulnerability has been patched in version 3.3.75. The root cause is insufficient validation and error handling of malformed input passed to the decodeURIComponent decoder.

## Affected products

- kujirahand nadesiko3 3.3.74 and earlier

## Identifiers

- CVE-2022-41777
- GHSA-x2jx-w3wm-9p3p

## Timeline

- 2022-12-05: disclosed: GHSA-x2jx-w3wm-9p3p and CVE-2022-41777 published
- 2022: patched: Fixed in version 3.3.75

## References

- [https://github.com/kujirahand/nadesiko3/issues/1325](https://github.com/kujirahand/nadesiko3/issues/1325)

## Related threats

- [nadesiko3 OS command injection](https://junglewise.ai/threats/cve-2022-42496-nadesiko3-os-command-injection)
- [Nadesiko3 OS command injection in compression](https://junglewise.ai/threats/cve-2022-41642-nadesiko3-os-command-injection-in-compression)