decode-uri-component CVE-2026-118664 (GHSA-qr28-fpjm-wq7f): a ~224 KB malformed URL string blocks the Node.js event loop for ~20 seconds, and 0.5.0 (the fix for the previous CVE) is affected. How do I find and update it?

What it is: decode-uri-component is a tiny npm package that decodes URL components without throwing on malformed input. It's pulled in transitively by very common packages (for example query-string, and older versions of tooling that parse URLs). When native decoding fails, its fallback took time proportional to the square of the input, so a single unauthenticated request of about 224 KB could freeze a Node.js server for about 20 seconds. Version 0.5.0, released to fix the earlier CVE-2026-45822, is still affected. Published October 29, 2026 (high); fixed in 0.5.1. Am I affected: - decode-uri-component 0.5.0 or earlier anywhere in your tree: npm ls decode-uri-component (or pnpm why / yarn why). - Real risk when a server decodes attacker-controlled URLs, query strings or headers through it (for example parsing request query strings with query-string). Front-end bundles and build tools are much lower risk. Fix: 1. Update to decode-uri-component 0.5.1 or later. Usually it's transitive: run npm update, update the parent package (query-string and others), or add an override (npm overrides / pnpm.overrides / yarn resolutions) forcing 0.5.1, then rebuild and redeploy. 2. As general hardening, limit URL and query-string length at the proxy or framework (most servers default to 8-16 KB for request lines and headers; keep those limits rather than raising them). Verify: npm ls decode-uri-component shows only 0.5.1+ in the deployed build and the lockfile is committed. Sources: https://github.com/SamVerschueren/decode-uri-component/security/advisories/GHSA-qr28-fpjm-wq7f https://nvd.nist.gov/vuln/detail/CVE-2026-118664 https://github.com/SamVerschueren/decode-uri-component/releases/tag/v0.5.1