Skip to main content
cve.nowby Sazabi
← npm
npmPackage

decode-uri-component

3 known vulnerabilities (2 high, 1 medium), with the versions each affects and the releases that fix them.

Latest release
0.5.1 (Oct 23, 2026): no advisory affects it
Newest unaffected release
0.5.1 (Oct 23, 2026), the latest release
Advisories
3 · 2 high, 1 medium
Weekly downloads
35.8M
Dependents
1,404
Releases
9 since 0.1.0 (May 19, 2017)
Registry
npm
Releases read
Nov 8, 2026

Version timeline

Every release cve.now has on record, lowest version on the left; each bar is a run of versions an advisory affects.

Advisories 3

  • decode-uri-component: Denial of service via quadratic replacement of percent-encoded runs

    Affected: fixed in 0.5.1.

    Fixed in 0.5.1 (released Oct 23, 2026, 5 days before disclosure).

    The latest release, 0.5.1, is not affected.

    94% of decode-uri-component downloads last week were affected versions (38.4M).

  • CVE-2026-45822Medium 6.6

    decode-uri-component through 0.4.1 is vulnerable to denial of service.

    Affected: fixed in 0.5.0.

    Fixed in 0.5.0 (released Jun 29, 2026, 1 day before disclosure).

    The latest release, 0.5.1, is not affected.

    89% of decode-uri-component downloads last week were affected versions (36.5M).

  • decode-uri-component 0.2.0 is vulnerable to Improper Input Validation resulting in DoS.

    Affected: fixed in 0.2.1.

    Fixed in 0.2.1 (released Dec 1, 2022, 3 days after disclosure).

    The latest release, 0.5.1, is not affected.

    11% of decode-uri-component downloads last week were affected versions (4.6M).