decode-uri-component can stall Node.js servers (CVE-2026-118664)

decode-uri-component: CVE-2026-118664

• What: CVE-2026-118664. One request of about 224 KB with malformed URL encoding can freeze a Node.js server for around 20 seconds. No authentication is required.
• Severity: High (8.2).
• Exploited: Not known to be exploited.
• Affected: Versions up to and including 0.5.0.
• Fixed in: 0.5.1.
• What to do:
  • Check whether the package is in your dependency tree, for example with pnpm why decode-uri-component or npm ls decode-uri-component.
  • If it is, upgrade it, or add a package-manager override that forces 0.5.1.

Also noted

• CISA's Known Exploited Vulnerabilities additions that day were for GitLab and Cisco firewalls.