CVE-2026-45822: Algorithmic Complexity Denial of Service in decode-uri-component

The decode-uri-component package is designed to safely parse and decode percent-encoded UTF-8 strings. It functions as a resilient utility, catching errors that native JavaScript decoders throw and attempting to output readable characters for invalid sequences. This fallback strategy introduces a substantial attack surface when handling unvalidated input from remote sources.\n\nThe vulnerability, registered as CVE-2026-45822, is classified under CWE-400 (Uncontrolled Resource Consumption) and CWE-407 (Inefficient Algorithmic Complexity). It manifests when the custom decoding fallback loop receives input structured to fail native decoding. Instead of running in linear time, the custom fallback router executes an inefficient recursive scheme.\n\nBecause Node.js operates on a single-threaded architecture, any blocking execution path halts the entire event loop. When a web server processes query parameters, header fields, or routing paths using a vulnerable version of this library, a single malicious payload can tie up the CPU thread indefinitely. This behavior allows remote, unauthenticated attackers to systematically exhaust server capacity.

The underlying flaw is located within the custom decoding logic of the index.js file. When the native decodeURIComponent() function encounters invalid sequences, such as isolated UTF-8 continuation bytes, it throws a URIError. The library catches this exception and redirects the parsing path to the custom fallback decode() subroutine.\n\nIn the pre-patched codebase, the input is first divided into tokens via a regular expression matcher. This separates percent-encoded bytes and literal characters into distinct elements in an array. The implementation then iterates through this token array using an outer loop that executes $N - 1$ times, where $N$ is the total token count. Within this loop, the library calls the recursive helper decodeComponents(tokens, i) with a dynamic split point.\n\nInside decodeComponents, if the overall native decoding attempt fails, the token array splits into left and right sub-arrays. However, during the subsequent recursive calls, no split parameter is supplied to the function. This omission causes the split value to default to one, forcing the recursion to process the array by peeling off exactly one token at a time. The combination of the outer loop running $N$ times and the recursive peeling taking $O(N^2)$ string allocations results in a total algorithmic complexity of $O(N^3)$, causing polynomial CPU scaling.

A close examination of the pre-patched and patched source code highlights how the recursive structure was replaced. The vulnerable implementation relies on array partitioning and repeated concatenation of divided tokens. This structure causes exponential allocation and evaluation steps for invalid sequence segments.\n\njavascript\n// Vulnerable custom fallback execution path\nfunction decodeComponents(components, split) {\n\ttry {\n\t\treturn [decodeURIComponent(components.join(''))];\n\t} catch {\n\t\t// Do nothing\n\t}\n\tif (components.length === 1) {\n\t\treturn components;\n\t}\n\tsplit = split || 1;\n\tconst left = components.slice(0, split);\n\tconst right = components.slice(split);\n\treturn Array.prototype.concat.call([], decodeComponents(left), decodeComponents(right));\n}\n\n\nThe patched implementation in version 0.5.0 completely eliminates decodeComponents and replaces it with a linear, single-pass scanner. It evaluates percent-encoded sequences sequentially from left to right. This state-machine approach ensures that invalid segments are ignored or printed literally in a single execution step without triggering backtracking or recursion.\n\njavascript\n// Patched linear custom fallback scanner\nfunction decode(input) {\n\ttry {\n\t\treturn decodeURIComponent(input);\n\t} catch {\n\t\tlet output = '';\n\t\tlet position = 0;\n\t\twhile (position < input.length) {\n\t\t\t// Linear iteration checks lead byte structure and skips backtracking\n\t\t\tconst firstByte = parsePercentByte(input, position);\n\t\t\t// ... [structural validation steps in O(n) complexity]\n\t\t}\n\t\treturn output;\n\t}\n}\n\n\nThis remediation path is complete and robust. By substituting the recursive array processing mechanism with a direct linear scanner, the library guarantees deterministic execution times even when processing highly malformed structures. There are no remaining paths in the codebase that can trigger secondary super-linear resource exhaustion.

Exploitation of CVE-2026-45822 requires no authentication, privilege, or special environment configuration. An attacker merely needs to transmit an HTTP request containing a string of invalid percent-encoded sequences to any component that parses input using the vulnerable library. Common targets include query string parsers, path parameter deserializers, and incoming header processors.\n\nThe payload must be constructed from repeating lone UTF-8 continuation bytes, such as %ab. Because these bytes do not form structurally complete UTF-8 sequences, they force the native parser to error out, routing the input directly into the vulnerable fallback code path. The longer the sequence of invalid tokens, the longer the main thread remains blocked.\n\nmermaid\ngraph LR\n A["Malicious HTTP Request"] --> B["decodeURIComponent(input)"]\n B -- "Throws URIError" --> C["Fallback decode() Method"]\n C --> D["Recursive Splitting Loop"]\n D --> E["Cubic O(N^3) Execution"]\n E --> F["Event Loop Blocked & 100% CPU Usage"]\n\n\nThe relationship between token length and processing time shows a sharp cubic curve. A payload containing 200 tokens blocks the CPU for less than a second, while a payload of 1400 tokens freezes the event loop for approximately 33 seconds. This freeze prevents the server from answering other legitimate incoming requests, leading to a complete service outage.

The impact of this vulnerability is severe for Node.js production environments. Because Node.js utilizes a single-threaded event loop, any synchronous code that consumes intensive CPU cycles will prevent the thread from processing other asynchronous events. This means a single concurrent request can effectively take down an entire container or server instance.\n\nWhile the CVSS v4.0 score is rated as 6.6, the threat in microservice architectures is disproportionately high. If an API gateway or ingress controller relies on a vulnerable version of decode-uri-component to parse query parameters, an attacker can disable the entire entry point of an enterprise network. This can be accomplished with negligible outbound traffic and minimal attacker bandwidth.\n\nAccording to current EPSS data, the probability of immediate exploitation is estimated at 0.00507 (41.20th percentile). However, due to the widespread distribution of this package as a transit dependency across the npm package registry, the actual corporate exposure rate remains high. Teams should prioritize remediation even if their direct application code does not import the library.

Remediation of CVE-2026-45822 requires upgrading the package to version 0.5.0 or above. Because this vulnerability is often introduced through third-party dependencies, developers must review and update lockfiles. Standard package manager update commands can resolve these nested dependencies automatically.\n\nTo identify vulnerable instances in your codebase, execute the dependency analyzer command npm ls decode-uri-component. If vulnerable versions (0.1.0 through 0.4.1) are detected, you can apply overrides in your project configuration. This forces package managers to resolve all instances to the secure version.\n\njson\n{\n "overrides": {\n "decode-uri-component": "^0.5.0"\n }\n}\n\n\nFor yarn-based environments, you should implement resolutions in the package.json file. This ensures that even indirect, nested dependencies are directed to use the safe version without breaking compatibility. Running security scans via npm audit inside continuous integration pipelines will help prevent the reintroduction of the vulnerable library.