Hacktoberfest 2026: the issues maintainers tagged for October, open and beginner-friendly. Browse Hacktoberfest issues

Fix decode-uri-component DoS (CVE-2026-45822) by dropping query-string

Open
  • Is something wrong?
#11,380 1 comment 0 reactions 0 assignees View on GitHub

Maintainers usually reply within 1 day

Nobody has claimed this yet.

  • #11387 by @bipul724 — closed without merging

Assessment

Difficulty
3/5
Estimated time
1-2 days
Newbie friendliness
68/100
Issue type
Bug
Clarity
Mostly clear
Activity status
Active
Tech stack
react, typescript
Domain
frontend, security

Research direction

Start with the internal query-string uses in fetch.ts, useListParams, and useRecordFromLocation, then inspect how fetchUtils.queryParameters is exposed. Replace those uses with the proposed native URLSearchParams-based helper while checking the existing default output and CJS build constraints. Done means the vulnerable dependency tree is removed and query output remains byte-for-byte identical; also verify the impact of dropping the undocumented options argument.

Written by the indexing model from the issue text.

Description

Is your feature request related to a problem? Please describe.

ra-core depends on query-string@^7.1.3, which pulls [email protected], affected by GHSA-vcc3-ghjq-m6fr / CVE-2026-45822 (moderate DoS via malformed percent-encoded input, reachable through URL query parsing). The only patched release is 0.5.0.

Describe the solution you'd like

Remove query-string and replace its internal uses (stringify in fetch.ts, parse in useListParams / useRecordFromLocation) with a small native URLSearchParams-based helper. This drops decode-uri-component (and filter-obj, split-on-first, strict-uri-encode) from the install tree with no ESM/CJS problems, and default output stays byte-for-byte identical.

Describe alternatives you've considered

  • Bump query-string to 9.5.x: the only releases depending on patched decode-uri-component@^0.5.0, but query-string 8+ is ESM-only (type: module), while ra-core ships a CJS build (require → dist/index.cjs does require("query-string")). Breaking for CJS/Node/Jest consumers.
  • Override just decode-uri-component: wouldn't help consumers either. resolutions/overrides only apply to the project that declares them, so an entry in react-admin's repo would fix its own install but consumers would still resolve the vulnerable version. And it doesn't work mechanically anyway, since the patched version is ESM-only and can't be required by query-string@7.

Additional context

The native replacement would drop the optional, undocumented StringifyOptions second argument of fetchUtils.queryParameters (currently an alias for query-string's stringify). It isn't used with options anywhere in the repo and isn't documented, but it is technically a public API change.

Would you accept that as part of this security fix in a minor/patch release, or would you prefer to hold it for a major? Happy to open the PR either way.

Dominant language
TypeScript
Stars
27k
Forks
5.5k
Avg merge
1d 3m
Merged PRs (30d)
32

Getting set up

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

More from marmelab/react-admin

All issues in marmelab/react-admin

Similar issues

More TypeScript issues

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.