OCPBUGS-94130: Fix CVE-2026-45822 decode-uri-component DoS vulnerability

[jrangelramos]

Analysis / Root cause

decode-uri-component through 0.4.1 is vulnerable to denial of service (CVE-2026-45822, CVSS 7.5). The decode() function splits input on % and calls decodeComponents(), which exhibits super-linear parsing time — 200 %ab tokens take ~0.7s, 700 tokens ~6s, 1400 tokens ~33s. An attacker can cause significant CPU consumption and event-loop blocking via crafted input.

The package is a transitive dependency pulled in by two paths:

• @console/git-service → gitlab@10.0.1 → query-string@6.8.3 → decode-uri-component@0.2.0
• snapdragon@0.8.2 → source-map-resolve@0.5.3 → decode-uri-component@0.2.0

Solution description

Bump decode-uri-component from 0.2.0 to 0.5.0 via yarn resolutions in frontend/package.json. Version 0.5.0 (upstream commit) rewrites the decoder as a single-pass UTF-8 scanner, eliminating the super-linear parsing behavior entirely.

This follows the existing pattern used for other CVE resolution overrides (shell-quote, protobufjs, fast-uri, etc.).

Test cases

• yarn install completes without errors
• Production build (webpack --mode=production) succeeds
• Unit test results identical before and after the change (345/218/1768 — pre-existing failures unrelated to this change)

Additional info

• Jira: OCPBUGS-94130
• CVE: CVE-2026-45822
• Upstream fix: decode-uri-component v0.5.0
• Bugzilla: BZ#2494807

Summary by CodeRabbit

• Chores
  • Updated package resolution to pin a dependency to version 0.5.0 for more consistent builds and fewer runtime surprises.
• Tests
  • Adjusted Jest configuration so decode-uri-component is processed during tests instead of being ignored, improving test coverage accuracy and reliability.

[openshift-ci-robot]

@jrangelramos: This pull request references Jira Issue OCPBUGS-94130, which is valid. The bug has been moved to the POST state.

3 validation(s) were run on this bug

• bug is open, matching expected state (open)
• bug target version (5.0.0) matches configured target version for branch (5.0.0)
• bug is in the state New, which is one of the valid states (NEW, ASSIGNED, POST)

The bug has been updated to refer to the pull request using the external bug tracker.

Details

In response to this:

Analysis / Root cause

decode-uri-component through 0.4.1 is vulnerable to denial of service (CVE-2026-45822, CVSS 7.5). The decode() function splits input on % and calls decodeComponents(), which exhibits super-linear parsing time — 200 %ab tokens take ~0.7s, 700 tokens ~6s, 1400 tokens ~33s. An attacker can cause significant CPU consumption and event-loop blocking via crafted input.

The package is a transitive dependency pulled in by two paths:

• @console/git-service → gitlab@10.0.1 → query-string@6.8.3 → decode-uri-component@0.2.0
• snapdragon@0.8.2 → source-map-resolve@0.5.3 → decode-uri-component@0.2.0

Solution description

Bump decode-uri-component from 0.2.0 to 0.5.0 via yarn resolutions in frontend/package.json. Version 0.5.0 (upstream commit) rewrites the decoder as a single-pass UTF-8 scanner, eliminating the super-linear parsing behavior entirely.

This follows the existing pattern used for other CVE resolution overrides (shell-quote, protobufjs, fast-uri, etc.).

Test cases

• yarn install completes without errors
• Production build (webpack --mode=production) succeeds
• Unit test results identical before and after the change (345/218/1768 — pre-existing failures unrelated to this change)

Additional info

• Jira: OCPBUGS-94130
• CVE: CVE-2026-45822
• Upstream fix: decode-uri-component v0.5.0
• Bugzilla: BZ#2494807

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

[openshift-ci]

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by: jrangelramos
Once this PR has been reviewed and has the lgtm label, please assign spadgett for approval. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

• frontend/OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Repository: openshift/coderabbit/.coderabbit.yaml

Review profile: CHILL

Plan: Enterprise

Run ID: ab14c7cd-dd02-4bdb-8691-0841809c7537

📥 Commits

Reviewing files that changed from the base of the PR and between e20e3b4 and 4ddadd1.

⛔ Files ignored due to path filters (1)

• frontend/yarn.lock is excluded by !**/yarn.lock, !**/*.lock

📒 Files selected for processing (1)

• frontend/package.json

---

Walkthrough

frontend/package.json now allows decode-uri-component in Jest transforms and pins the package to version 0.5.0 in Yarn resolutions.

Changes

frontend package configuration

Layer / File(s)	Summary
Jest allowlist and Yarn resolution frontend/package.json	Adds decode-uri-component to Jest’s transformIgnorePatterns allowlist and pins it to 0.5.0 in resolutions.

Estimated code review effort: 1 (Trivial) | ~2 minutes

🚥 Pre-merge checks | ✅ 14 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Microshift Test Compatibility	⚠️ Warning	project-dashboard.spec.ts creates console.openshift.io/v1 ConsoleLink and expects DeploymentConfig, with no MicroShift skip/tag.	Add a MicroShift guard or [Skipped:MicroShift]/[apigroup:console.openshift.io] tag, and avoid DeploymentConfig-specific expectations on that test.

✅ Passed checks (14 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title is specific, concise, and accurately matches the main change: fixing the decode-uri-component CVE.
Description check	✅ Passed	The required core sections are present and detailed; only some optional template sections like screenshots and browser conformance are missing.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Stable And Deterministic Test Names	✅ Passed	PR only changes frontend/package.json and frontend/yarn.lock; no Ginkgo tests or test titles were added or modified.
Test Structure And Quality	✅ Passed	Latest commit only changes frontend/package.json and yarn.lock; no Ginkgo test files or test logic were touched.
Single Node Openshift (Sno) Test Compatibility	✅ Passed	No Ginkgo e2e tests were added; the PR only changes frontend/package.json and yarn.lock dependency resolutions.
Topology-Aware Scheduling Compatibility	✅ Passed	Only frontend/package.json and frontend/yarn.lock changed; no deployment manifests, controllers, or scheduling logic were modified.
Ote Binary Stdout Contract	✅ Passed	PR only changes frontend/package.json resolution/transformIgnorePatterns; no process-level Go/JS test-binary code or stdout writes were modified.
Ipv6 And Disconnected Network Test Compatibility	✅ Passed	PR only updates package resolution metadata in frontend/package.json/yarn.lock; it adds no Ginkgo e2e tests or networking code.
No-Weak-Crypto	✅ Passed	PR only updates package resolutions and lockfile for decode-uri-component; no weak crypto, custom crypto, or secret comparisons were added.
Container-Privileges	✅ Passed	Only package resolution files changed; no privileged, host namespace, or allowPrivilegeEscalation settings were added.
No-Sensitive-Data-In-Logs	✅ Passed	The PR only updates dependency resolutions in package.json and yarn.lock; it adds no new logging or data exposure paths.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[openshift-ci-robot]

@jrangelramos: This pull request references Jira Issue OCPBUGS-94130, which is valid.

3 validation(s) were run on this bug

• bug is open, matching expected state (open)
• bug target version (5.0.0) matches configured target version for branch (5.0.0)
• bug is in the state POST, which is one of the valid states (NEW, ASSIGNED, POST)

Details

In response to this:

Analysis / Root cause

decode-uri-component through 0.4.1 is vulnerable to denial of service (CVE-2026-45822, CVSS 7.5). The decode() function splits input on % and calls decodeComponents(), which exhibits super-linear parsing time — 200 %ab tokens take ~0.7s, 700 tokens ~6s, 1400 tokens ~33s. An attacker can cause significant CPU consumption and event-loop blocking via crafted input.

The package is a transitive dependency pulled in by two paths:

• @console/git-service → gitlab@10.0.1 → query-string@6.8.3 → decode-uri-component@0.2.0
• snapdragon@0.8.2 → source-map-resolve@0.5.3 → decode-uri-component@0.2.0

Solution description

Bump decode-uri-component from 0.2.0 to 0.5.0 via yarn resolutions in frontend/package.json. Version 0.5.0 (upstream commit) rewrites the decoder as a single-pass UTF-8 scanner, eliminating the super-linear parsing behavior entirely.

This follows the existing pattern used for other CVE resolution overrides (shell-quote, protobufjs, fast-uri, etc.).

Test cases

• yarn install completes without errors
• Production build (webpack --mode=production) succeeds
• Unit test results identical before and after the change (345/218/1768 — pre-existing failures unrelated to this change)

Additional info

• Jira: OCPBUGS-94130
• CVE: CVE-2026-45822
• Upstream fix: decode-uri-component v0.5.0
• Bugzilla: BZ#2494807

Summary by CodeRabbit

• Chores
• Updated a package resolution to pin a dependency to a safer compatible version, helping improve build consistency and reduce runtime issues.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

[jrangelramos]

/retest-required

[jrangelramos]

/retest-required

[openshift-ci]

@jrangelramos: all tests passed!

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.