CVE-2026-118664: decode-uri-component vulnerable to denial of service via quadratic replacement of percent-encoded runs

Severity: high. ### Summary `decodeUriComponent()` takes quadratic time on malformed input that has many distinct percent-encoded runs. A single unauthenticated request of about 224 KB can block the Node.js event loop for about 20 seconds. Version 0.5.0, the release that fixed CVE-[phone], is affected. ### Det

Читать первоисточник →