# CVE-2026-118664: decode-uri-component ReDoS in percent-encoding handling

Source: https://junglewise.ai/threats/cve-2026-118664-decode-uri-component-provides-a-more-robust-alternative-to  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-28. Updated: 2026-10-28  
License: CC BY 4.0 with a link back

CVE-2026-118664 · Severity: high · CVSS 4 · Published 2026-10-28

The decode-uri-component library, used to safely decode URL-encoded text in web applications, has a regular expression denial-of-service (ReDoS) vulnerability in versions before 0.5.1. An attacker can craft malformed URL input with many distinct percent-encoded sequences that causes the decoder to perform quadratic work, consuming CPU and blocking the Node.js event loop, leading to service unavailability.

Technologies: [decode-uri-component (npm)](https://junglewise.ai/threats/technologies/npm-decode-uri-component). Vendors: [npm](https://junglewise.ai/threats/vendors/npm).

## Quick answers

**Is CVE-2026-118664 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-118664 being exploited in the wild.

**How severe is CVE-2026-118664?** High severity, with a CVSS score of 4, published 28 October 2026.

**Which products and versions are affected?** decode-uri-component (npm) <= 0.5.0, SEMVER:introduced=0,fixed=0.5.1; Sam Verschueren Decode-Uri-Component before 0.5.1.

**Is there a fix for CVE-2026-118664?** Yes. decode-uri-component (npm): upgrade to 0.5.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-118664 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-118664?** Check whether you run decode-uri-component (npm) or Sam Verschueren Decode-Uri-Component at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- decode-uri-component (npm): upgrade to 0.5.1 or later

  ```sh
  npm install decode-uri-component@0.5.1
  ```


## Technical details

The vulnerability exists in index.js where the fallback decoder collects distinct percent-encoded runs and then applies a full-string regex replacement for each entry, causing quadratic time complexity. On malformed input with many distinct percent-encoded sequences, an attacker can trigger excessive CPU consumption and event loop blocking. This is fixed in version 0.5.1 by decoding percent-encoded runs in a single pass instead of repeatedly scanning the string.

## Affected products

- Sam Verschueren decode-uri-component before 0.5.1

## Identifiers

- CVE-2026-118664
- GHSA-qr28-fpjm-wq7f

## Timeline

- 2026-10-28: disclosed
- 2026-10-23: patched

## References

- [https://github.com/SamVerschueren/decode-uri-component/commit/fad01d65b93bd3f2f0dc32dfd8d57a38b57bc608](https://github.com/SamVerschueren/decode-uri-component/commit/fad01d65b93bd3f2f0dc32dfd8d57a38b57bc608)
- [https://github.com/SamVerschueren/decode-uri-component/releases/tag/v0.5.1](https://github.com/SamVerschueren/decode-uri-component/releases/tag/v0.5.1)

## Related threats

- [SamVerschueren decode-uri-component denial of service in decode function](https://junglewise.ai/threats/cve-2026-45822-samverschueren-decode-uri-component-denial-of-service-in-decode)
- [decode-uri-component denial of service via improper input validation](https://junglewise.ai/threats/cve-2022-38900-decode-uri-component-denial-of-service-via-improper-input)