decode-uri-component: Denial of service via quadratic replacement of percent-encoded runs

Özet

Türkçe özeti henüz hazır değil; şimdilik kaynağın kendi açıklamasını gösteriyoruz.

decode-uri-component provides a more robust alternative to decodeURIComponent. Prior to 0.5.1, decodeUriComponent in index.js falls back to customDecodeURIComponent after native decoding throws, and the fallback collects every distinct percent-encoded run before performing a full-string regular-expression replacement for each entry. Malformed input containing many distinct runs can therefore make both the number of replacements and the scanned input length grow together, causing quadratic CPU consumption and blocking the Node.js event loop; request-body inputs can reach the demonstrated size, while ordinary URL header limits reduce the practical delay. This issue is fixed in version 0.5.1.

Etkilenen sürümler1 yazılım

Kaynaklar5 kaynak

• CVE.org kaydı
• NVD kaydı
• github.com/…ponent/security/advisories/GHSA-qr28-fpjm-wq7f Diğer
• github.com/…ommit/fad01d65b93bd3f2f0dc32dfd8d57a38b57bc608 Diğer
• github.com/…ueren/decode-uri-component/releases/tag/v0.5.1 Diğer

Kayıt geçmişi

1. 28 Eki 2026 23:37Yayımlandı

İlgili açıklar

• 7,5 CVE-2026-118694python-markdown2 through 2.5.5 Denial of Service via Unclosed Inline Link Destinations
• 8,2 CVE-2026-118261Echo: Decompress permits unbounded gzip expansion in v4
• 8,2 CVE-2026-118260Echo: BodyDump captures request and response bodies without size limits in v4
• 7,5 CVE-2026-116795RE2JS: Quadratic-time denial of service in re2js lookbehind matching
• 6,5 CVE-2026-88858Server-side expression parser denial of service
• 7,5 CVE-2026-118036Uncontrolled Resource Consumption in Telerik Document Processing Libraries RadPdfProcessing and AI Document Summarization and Question Answering