CVE-2026-45822

MEDIUM

Samverschueren Decode-uri-component < 0.5.0 - Uncontrolled Resource Consumption

Title source: rule
STIX 2.1

Exploitation Summary

EIP tracks 1 public exploit for CVE-2026-45822. PoCs published by HermesNA-1.

AI-analyzed exploit summary This repository contains an auto-generated stub module for CVE-2026-45822, a denial-of-service vulnerability in the decode-uri-component npm package (versions through 0.4.1). The module includes placeholder code with no functional exploit implementation, only connection probing logic.

Description

decode-uri-component through 0.4.1 is vulnerable to denial of service. The decode() function splits input on '%' producing N tokens and calls decodeComponents(), exhibiting super-linear parsing time: 200 '%ab' tokens takes approximately 0.7s, 700 tokens approximately 6s, and 1400 tokens approximately 33s. An attacker can cause significant CPU consumption and event-loop blocking via crafted input.

Exploits (1)

github STUB 1 stars
by HermesNA-1 · pythonpoc
https://github.com/HermesNA-1/SnakeSploit/tree/main/data/modules_generated/cve-2026-45822_decode-uri-component_through_041.py

This repository contains an auto-generated stub module for CVE-2026-45822, a denial-of-service vulnerability in the decode-uri-component npm package (versions through 0.4.1). The module includes placeholder code with no functional exploit implementation, only connection probing logic.

Classification
Stub 98%
Attack Type
Dos
Complexity
Moderate
Reliability
Theoretical
Target: decode-uri-component (npm package) through 0.4.1
No auth needed
Prerequisites: Target must be running a service that uses the vulnerable decode-uri-component package · Network access to the target service
mistral-large-3 · analyzed Jul 09, 2026 Full analysis →

References (3)

Core 3

Scores

CVSS v4 6.6
EPSS 0.0029
EPSS Percentile 21.4%
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:N/AU:Y/R:U/V:D/RE:M/U:Amber

CISA SSVC

Vulnrichment
Exploitation none
Automatable yes
Technical Impact partial

Details

CWE
CWE-400 CWE-407
Status published
Products (1)
SamVerschueren/decode-uri-component 0.1.0 - 0.5.0
Published Jun 30, 2026
Tracked Since Jun 30, 2026