CVE-2026-45822: 
Linux Ubuntu vulnerability analysis and mitigation

CVE-2026-45822 is a Denial of Service vulnerability in the decode-uri-component npm package (by SamVerschueren) affecting versions 0.1.0 through 0.4.1 (fixed in 0.5.0). The flaw causes super-linear CPU consumption when processing crafted input strings containing many % characters, leading to event-loop blocking in Node.js applications. It was published on June 30, 2026, with a CVSS v3.1 base score of 7.5 (High) and a CVSS v4.0 base score of 6.6 (Medium) (Red Hat Advisory, Red Hat Bugzilla).

The root cause is Uncontrolled Resource Consumption (CWE-400) combined with Inefficient Algorithmic Complexity (CWE-407) and Excessive Platform Resource Consumption within a Loop (CWE-1050). In the vulnerable decode() function, input is split on % characters into N tokens, and each token is recursively processed by decodeComponents(), which uses a divide-and-conquer approach that exhibits super-linear (approximately O(N²) or worse) time complexity. Benchmarks show that 200 %ab tokens take ~0.7s, 700 tokens ~6s, and 1400 tokens ~33s of processing time. The fix (commit fa479da) rewrites the decoder as a single-pass O(n) UTF-8 scanner, eliminating the recursive splitting entirely (GitHub Source, GitHub Fix Commit).

Successful exploitation allows an unauthenticated remote attacker to cause significant CPU exhaustion and block the Node.js event loop in any application that passes untrusted input to decode-uri-component. This results in a complete availability impact — the application becomes unresponsive for the duration of processing — with no confidentiality or integrity impact. Because the package is widely used as a dependency in the npm ecosystem, the blast radius may extend to many downstream applications that indirectly depend on it (Red Hat Bugzilla, Red Hat Advisory).

No public proof-of-concept exploit code has been reported, and there is no evidence of in-the-wild exploitation at this time. The EPSS score is approximately 0.30%, indicating a low probability of exploitation in the near term. The vulnerability is automatable (no user interaction or privileges required), making it straightforward to trigger remotely. It has not been added to the CISA Known Exploited Vulnerabilities (KEV) catalog, and the CVSSv4 exploit maturity is rated "Unreported" (Red Hat Advisory).

1. Reconnaissance: Identify applications that accept user-controlled URL or query string input and use decode-uri-component version ≤ 0.4.1 as a direct or transitive dependency (e.g., via npm ls decode-uri-component or dependency scanning tools).
2. Craft malicious payload: Construct a string containing a large number of %ab-style percent-encoded tokens (e.g., %ab repeated 700–1400 times), which will trigger the super-linear parsing path in the decode() function.
3. Deliver payload: Submit the crafted string as input to any endpoint that passes it to decodeUriComponent() — such as a URL query parameter, path segment, or form field processed by the vulnerable library.
4. Trigger DoS: The decode() function splits the input on %, producing N tokens, and recursively calls decodeComponents() in a divide-and-conquer loop, consuming excessive CPU and blocking the Node.js event loop for tens of seconds per request.
5. Sustain attack: Repeat requests with large payloads to keep the event loop blocked, rendering the application unresponsive to legitimate users (GitHub Source, Red Hat Bugzilla).

• Network: Repeated HTTP requests containing URL-encoded strings with large numbers of %XX sequences (e.g., %ab%ab%ab... repeated hundreds of times) in query parameters, path segments, or request bodies.
• Logs: Application or web server access logs showing requests with unusually long percent-encoded strings; slow response times or timeouts correlated with specific request patterns.
• Process: Node.js process showing sustained near-100% CPU utilization; event loop lag metrics spiking significantly during or after specific requests; application health checks failing or timing out.
• Application Metrics: Elevated request latency or queue depth without a corresponding increase in legitimate traffic volume.

Update decode-uri-component to version 0.5.0 or later, which rewrites the decoder as a single-pass O(n) UTF-8 scanner (commit fa479da), eliminating the super-linear complexity (GitHub Fix Commit). As interim workarounds, implement input validation to restrict the number of % characters accepted in a single request, and apply rate limiting on endpoints that process URL-encoded input. Organizations should also audit transitive dependencies using tools like npm audit or npm ls decode-uri-component to identify all affected usage paths (Red Hat Advisory).

Red Hat has tracked this vulnerability with high severity in their Bugzilla system (Bug 2494807), with 68 users on the CC list indicating broad internal interest across Red Hat product teams. The CVE status is listed as "Deferred" by Red Hat, suggesting it is being evaluated for impact across their product portfolio. No significant public researcher commentary or media coverage has been identified beyond standard vulnerability database entries (Red Hat Bugzilla).