CVE-2026-45822

ADVISORY - github

Summary

Impact

An attacker who can supply input to decodeUriComponent() (directly or via a dependency that uses this package on URL/query/path data) can cause excessive CPU usage and application unresponsiveness. This is an availability issue; there is no known memory corruption, data disclosure, or remote code execution impact.

Patches

Upgrade to decode-uri-component@0.5.0.

Workarounds

Limit the size of the input.

EPSS Score⁠: 0.00507 (0.412)

Common Weakness Enumeration (CWE)

ADVISORY - github

CWE-1176⁠

Inefficient CPU Computation

CWE-400⁠

Uncontrolled Resource Consumption

CWE-405⁠

Asymmetric Resource Consumption (Amplification)

CWE-407⁠

Inefficient Algorithmic Complexity

ADVISORY - redhat

CWE-1050⁠

Excessive Platform Resource Consumption within a Loop

Impacted images

Sign in to Docker Scout

See which of your images are affected by this CVE and how to fix them by signing into Docker Scout.