CVE-2026-118664

About vulnerability

decode-uri-component provides a more robust alternative to decodeURIComponent. Prior to 0.5.1, decodeUriComponent in index.js falls back to customDecodeURIComponent after native decoding throws, and the fallback collects every distinct percent-encoded run before performing a full-string regular-expression replacement for each entry. Malformed input containing many distinct runs can therefore make both the number of replacements and the scanned input length grow together, causing quadratic CPU consumption and blocking the Node.js event loop; request-body inputs can reach the demonstrated size, while ordinary URL header limits reduce the practical delay. This issue is fixed in version 0.5.1.

Affected product:

@walletconnect/legacy-utils , AngularJS , Babel , Lodash , Next.js , React , Vue , aegir , airgap-beacon-blockchain-substrate , airgap-beacon-blockchain-tezos , airgap-beacon-dapp , airgap-beacon-sdk , airgap-beacon-transport-walletconnect , airgap-beacon-ui , angular-compiler-cli , angular-devkit-core , anymatch , apollo , appkit , authereum , babel-cli , babel-jest , babel-loader , babel-plugin-add-module-exports , babel-plugin-remove-graphql-queries , babel-preset-expo , beacon-sdk , bin-wrapper , blockchain-link-utils , blocks , blocks-editor , blockstack.js , braces , broccoli , bugsnag-plugin-react-navigation , cache-loader , cacheable-request , celo-celocli , celo-connect , celo-contractkit , celo-dev-utils , celo-encrypted-backup , celo-explorer , celo-governance , celo-identity , celo-keystores , celo-phone-number-privacy-common , celo-utils , celo-wallet-base , celo-wallet-hsm , celo-wallet-hsm-azure , celo-wallet-hsm-gcp , celo-wallet-ledger , celo-wallet-local , celo-wallet-remote , celo-wallet-rpc , chain-jslib , chialab-rna-saucelabs-test-runner , chokidar , clean-webpack-plugin , codeshift-core , compare-urls , compression-webpack-plugin , copy-webpack-plugin , core-js-builder , cpy , create-expo-module , create-react-app , critters , css , css-loader , css-parse , cwebp-bin , cz-cli , decode-uri-component , developer-tooling , documentation , docusaurus , ecadlabs-beacon-dapp , ecadlabs-beacon-transport-walletconnect , electron-webpack , electron-webpack-js , ember-cli , ember-cli/broccoli-sane-watcher , enzyme-matchers , epub-maker2 , eslint-loader , eslint-webpack-plugin , eth-lib , expand-brackets , expect , expo , expo-asset , expo-auth-session , expo-blur , expo-cli , expo-config , expo-constants , expo-dev-client-components , expo-dev-tools , expo-device , expo-electron-adapter , expo-expo-cli , expo-file-system , expo-font , expo-glass-effect , expo-haptics , expo-image , expo-keep-awake , expo-linking , expo-localization , expo-mail-composer , expo-metro-config , expo-module-scripts , expo-next-adapter , expo-prebuild-config , expo-router , expo-router-server , expo-screen-capture , expo-splash-screen , expo-status-bar , expo-stories , expo-symbols , expo-system-ui , expo-template-bare-minimum , expo-template-default , expo-template-tabs , expo-vector-icons , expo-web-browser , expo-webpack-config , expo-widgets , expo-xdl , expo-yarn-workspaces , extglob , extract-css-chunks-webpack-plugin , extract-from-css , extract-text-webpack-plugin , facebook/react-native , fast-glob , file-loader , find-node-modules , find-yarn-workspace-root , findup-sync , fork-ts-checker-webpack-plugin , friendly-errors-webpack-plugin , gatsby , gatsby-cli , gatsby-cypress , gatsby-interface , gatsby-page-utils , gatsby-plugin-compile-es6-packages , gatsby-plugin-emotion , gatsby-plugin-fathom , gatsby-plugin-feed , gatsby-plugin-google-gtag , gatsby-plugin-guess-js , gatsby-plugin-less , gatsby-plugin-manifest , gatsby-plugin-netlify , gatsby-plugin-no-sourcemaps , gatsby-plugin-offline , gatsby-plugin-page-creator , gatsby-plugin-postcss , gatsby-plugin-preact , gatsby-plugin-preload-fonts , gatsby-plugin-react-helmet , gatsby-plugin-schema-snapshot , gatsby-plugin-sharp , gatsby-plugin-sitemap , gatsby-plugin-styletron , gatsby-plugin-typography , gatsby-react-router-scroll , gatsby-remark-code-repls , gatsby-remark-embed-snippet , gatsby-remark-prismjs , gatsby-remark-responsive-iframe , gatsby-source-contentful , gatsby-source-drupal , gatsby-source-filesystem , gatsby-source-graphql , gatsby-source-shopify , gatsby-source-wordpress , gatsby-transformer-react-docgen , gatsby-transformer-remark , gatsby-transformer-sqip , gatsby-transformer-toml , get-workspaces , gh-got , git-up , git-url-parse , glob-watcher , globby , googlemaps-google-maps-services-js , got , guess , gulp , gulp-cli , hard-source-webpack-plugin , html-loader , html-webpack-plugin , http-proxy-middleware , imagemin , imagemin-jpegtran , imagemin-mozjpeg , imagemin-optipng , imagemin-pngquant , imagemin-webp , ionic-v1-toolkit , istanbul-instrumenter-loader , jest , jest-circus , jest-cli , jest-config , jest-core , jest-each , jest-emotion , jest-environment , jest-environment-jsdom , jest-environment-jsdom-fourteen , jest-environment-node , jest-expo , jest-expo-enzyme , jest-fake-timers , jest-haste-map , jest-jasmine2 , jest-message-util , jest-repl , jest-reporters , jest-resolve-dependencies , jest-runner , jest-runtime , jest-snapshot , jest-specific-snapshot , jest-test-result , jest-test-sequencer , jest-transform , jest-util , jest-watch-typeahead , jest-watcher , jovidecroock-prefresh , jpegtran-bin , js-matchdep , jscodeshift , karma , karma-webpack , kesla/download-tarball , kevva/download , ledger-cosmos-js , ledger-live , ledgerhq-coin-celo , ledgerhq-domain-service , ledgerhq-live-cli , ledgerhq-live-common , lerna , lerna-github-client , less-loader , libp2p-interfaces-compliance-tests , liftoff , magic-js , mdx , metro , metro-cache , metro-config , metro-core , metro-transform-worker , micromatch , mini-css-extract-plugin , minimizer-webpack-plugin , modern-js-create-request , modern-js-plugin-bff , monorepo , mozjpeg-bin , nanomatch , nguniversal , nguniversal-common , nicolo-ribaudo-chokidar-2 , node-novel-fetch-file-or-url , node-novel-imagemin , node-saucelabs , nodejs-proto-files , normalize-url , novel-epub , npm:@blockshake/defly-connect , npm:gatsby-theme-blog-core , null-loader , nuxt , onflow-fcl-rainbowkit-adapter , open-wc , open-wc-building-webpack , open-wc-testing-karma , opencensus-node , optimize-css-assets-webpack-plugin , optipng-bin , panda , parcel-bundler , parse-path , parse-url , patch-package , pngquant-bin , porto , postcss-loader , prefresh-webpack , preload-webpack-plugin , privy-io , probe.gl , progress-bar-webpack-plugin , query-string , qunit , rainbowkit , raw-loader , readdirp , relay , releaser-tools , reown-appkit , reown-appkit-adapter-bitcoin , reown-appkit-adapter-ethers , reown-appkit-adapter-ethers5 , reown-appkit-adapter-solana , reown-appkit-adapter-wagmi , reown-appkit-controllers , reown-appkit-core , reown-appkit-experimental , reown-appkit-pay , reown-appkit-scaffold-ui , reown-appkit-siwe , reown-appkit-siwx , reown-appkit-ui , reown-appkit-universal-connector , reown-appkit-utils , reown-appkit-wallet-button , resolve-url-loader , rework , rollup-plugin-sourcemaps , rushstack-hashed-folder-copy-plugin , rushstack-heft-webpack4-plugin , rushstack-webpack-plugin-utilities , rushstack-webpack4-localization-plugin , rushstack-webpack4-module-minifier-plugin , sane , sass-loader , sb , schema-utils , schematics-angular , script-ext-html-webpack-plugin , sentry-gatsby , snapdragon , solana-wallet-adapter-example , source-map-resolve , stacks-auth , storybook , storybook-addon-controls , storybook-addon-docs , storybook-addon-essentials , storybook-addon-interactions , storybook-angular , storybook-builder-webpack5 , storybook-cli , storybook-codemod , storybook-core , storybook-core-client , storybook-core-common , storybook-core-server , storybook-ember , storybook-html , storybook-preact , storybook-preset-vue3-webpack , storybook-react , storybook-server , storybook-svelte , storybook-telemetry , storybook-vue3 , storybook-vue3-webpack5 , storybook-web-components , stx-labs-stacks.js , stx-labs/stacks.js , style-loader , style-resources-loader , stylus , stylus-loader , svgr , swarm-js , taquito-beacon-wallet , taquito-wallet-connect , theme-ui , thread-loader , time-fix-plugin , torus-embed , torus.js , trezor-connect-web , trezor-env-utils , trezor-suite , ts-jest , ts-loader , uglifyjs-webpack-plugin , unified-args , url-loader , use-wallet , vincentdchan/webpack-deep-scope-analysis-plugin , wagmi , wagmi-connectors , wallet-adapter , walletconnect-core , walletconnect-ethereum-provider , walletconnect-legacy-client , walletconnect-monorepo , walletconnect-sign-client , walletconnect-signer-connection , walletconnect-solana-adapter , walletconnect-universal-provider , walletconnect-utils-scoped , walletconnect/walletconnect-monorepo , watcher , watchpack , wdio-sauce-service , web-test-runner-saucelabs , web3 , web3-bzz , web3-core , web3-core-helpers , web3-core-method , web3-core-requestmanager , web3-core-subscriptions , web3-eth , web3-eth-accounts , web3-eth-contract , web3-eth-ens , web3-eth-iban , web3-eth-personal , web3-net , web3-providers-http , web3-providers-ipc , web3-providers-ws , web3-react , web3-shh , web3-utils , web3.js , web3modal , webpack , webpack-assets-manifest , webpack-cli , webpack-dev-middleware , webpack-dev-server , webpack-filter-warnings-plugin , webpack-manifest-plugin , webpack-subresource-integrity , webpackbar , workbox , worker-loader , x402 , x402-paywall , xdl , xhr-request , xhr-request-promise

Affected packages:

decode-uri-component @ 0.2.0 (+3617 more)