react-navigation/core 7.20 decode-uri-component: Denial of service via exponential decoding of malformed percent-encoded input from query-string
Author: JustASillyDudeCreated Sep 15, 2026Updated Sep 15, 2026
Labelsbugneeds repro
Current behavior
Expected behavior
no fix available its vurnabilities.
Reproduction
https://github.com/react-navigation/react-navigation/tree/main/packages/core
Platform
- Android
- iOS
- Web
- Windows
- MacOS
Packages
- @react-navigation/bottom-tabs
- @react-navigation/drawer
- @react-navigation/material-top-tabs
- @react-navigation/stack
- @react-navigation/native-stack
- react-native-drawer-layout
- react-native-tab-view
Environment
- [] I've removed the packages that I don't use
| package | version |
|---|---|
| @react-navigation/native | |
| @react-navigation/bottom-tabs | |
| @react-navigation/drawer | |
| @react-navigation/material-top-tabs | |
| @react-navigation/stack | |
| @react-navigation/native-stack | |
| react-native-drawer-layout | |
| react-native-tab-view | |
| react-native-screens | |
| react-native-safe-area-context | |
| react-native-gesture-handler | |
| react-native-reanimated | |
| react-native-pager-view | |
| react-native | |
| expo | |
| node | |
| npm or pnpm |
Source: react-navigation/react-navigation