react-navigation/core 7.20 decode-uri-component: Denial of service via exponential decoding of malformed percent-encoded input from query-string

Author: JustASillyDudeCreated Sep 15, 2026Updated Sep 15, 2026
Labelsbugneeds repro

Current behavior

ImageImage "react": "19.1.4", "react-native": "0.81.6",

Expected behavior

no fix available its vurnabilities.

Reproduction

https://github.com/react-navigation/react-navigation/tree/main/packages/core

Platform

  • Android
  • iOS
  • Web
  • Windows
  • MacOS

Packages

  • @react-navigation/bottom-tabs
  • @react-navigation/drawer
  • @react-navigation/material-top-tabs
  • @react-navigation/stack
  • @react-navigation/native-stack
  • react-native-drawer-layout
  • react-native-tab-view

Environment

  • [] I've removed the packages that I don't use
package version
@react-navigation/native
@react-navigation/bottom-tabs
@react-navigation/drawer
@react-navigation/material-top-tabs
@react-navigation/stack
@react-navigation/native-stack
react-native-drawer-layout
react-native-tab-view
react-native-screens
react-native-safe-area-context
react-native-gesture-handler
react-native-reanimated
react-native-pager-view
react-native
expo
node
npm or pnpm

Source: react-navigation/react-navigation