---
title: "decode-uri-component: one request can stall Node, update to 0.5.1"
description: "decode-uri-component up to 0.5.0 takes quadratic time on malformed input, so one request of about 224 KB can block the Node.js event loop for about 20 seconds. The fix is in 0.5.1."
url: https://ihsanalapsi.dev/articles/decode-uri-component-dos-fix
lang: en
date: 2026-10-30
updated: 2026-10-30
tags: ["App security", "Security updates", "Web development"]
author: Ihsan Alapsi (إحسان العبسي)
---
# decode-uri-component: one request can stall Node, update to 0.5.1

If your Node.js app decodes URLs or form data that come from outside, there is a flaw in a small library called decode-uri-component that lets one request stall the app for seconds. Here is how to tell whether your project is affected, and how to find the library and update it.

## What is the decode-uri-component flaw?

The decode-uri-component flaw is that when the normal decode fails on malformed input, the library runs over the whole string once for each distinct encoded run, so the time grows quadratically with the input length.

The advisory in the GitHub Advisory Database is GHSA-qr28-fpjm-wq7f, and the flaw is CVE-2026-118664.

The [GitHub advisory](https://github.com/advisories/GHSA-qr28-fpjm-wq7f) rates it high: 8.2 on CVSS 4.0.

## Why is one request enough?

The reason is that Node.js runs your app's code on a single thread. When the function gets stuck in a long computation, every other request waits behind it.

The advisory gives the number: a single unauthenticated request of about 224 KB can block the event loop for about 20 seconds.

Pay attention to version 0.5.0. It is the release that fixed an earlier flaw (CVE-2026-45822), and the advisory says it is affected by this one too, because the first fix left the replacement loop unchanged.

## Is my app affected?

Your app is affected if it has decode-uri-component 0.5.0 or older, and outside input reaches `decodeUriComponent()`, from your code or from another package.

The advisory names query-string as an example of a dependency that passes input to the library. It separates two cases:


| Where the input is                                                              | How big the risk is                                                 |
| ------------------------------------------------------------------------------- | ------------------------------------------------------------------- |
| In the URL (query string)                                                       | Node's default 16 KB header limit keeps a request to about 40 ms    |
| In the request body (a form you parse with `query-string.parse()`, for example) | The advisory says apps that decode request bodies are fully exposed |


So if you decode form bodies or encoded data that users send, that is the first place to check.

If you are updating Node.js itself this month as well, see [the October Node.js security releases](/articles/nodejs-october-2026-security-releases).

## How do you fix it?

Update decode-uri-component to 0.5.1. First, see what brings it into your project:

```bash
npm ls decode-uri-component
```

If it is in your own `dependencies`, update it:

```bash
npm install decode-uri-component@0.5.1
```

If it comes from another package, update that package to a version that pulls in 0.5.1. If there is none yet, you can force the version with `overrides` in `package.json`, but test the app afterwards, because the parent package may be written against an older version.

The advisory gives no workaround. The update is the fix.

## Where do you start now?

Start with your dependency tree and the places where you decode user input.

1. Run `npm ls decode-uri-component` and check for version 0.5.0 or older.
2. Search your code for `query-string.parse` and any request body decoding, and see whether the input comes from outside.
3. Update to 0.5.1, and test the app.

If you want someone to test your platform the way an attacker would, including the requests that stall it, that is what [Muhassan](/muhassan) does.

All our app security articles are in one place: [App security](/articles?tag=app-security).

## FAQ

**Does the attacker need an account on my app?**

No. The advisory describes a single unauthenticated request that is enough to block the event loop.

**I do not use decode-uri-component in my code. Why could I be affected?**

Because it reaches your project through other packages. The advisory names query-string as an example of a dependency that passes input to decodeUriComponent.

**Does it leak data?**

No. According to the advisory's score, the impact is on availability only, with no impact on confidentiality or integrity.