Package
kibana-9.4
Component
decode-uri-component
Latest update
Build, ship, and run secure software with minimal, hardened container images — rebuilt from source daily and guarded under our industry-leading remediation SLA.
Start for freeStatus
Impact
decode-uri-component is affected by CVE-2026-45822, and no fixed version can currently be shipped in kibana.
The fix is available only in decode-uri-component 0.5.0, which is published as ESM-only. kibana reaches this package through query-string 6.13.2, which is CommonJS. In the compiled kibana browser bundle, loading the ESM-only release through require() yields a module namespace object rather than a callable function, so URL parsing throws at runtime and core UI pages including Discover and Fleet Agents fail to load.
No release of decode-uri-component both carries the fix and remains usable from CommonJS. Remediation depends on upstream kibana migrating to an ESM query-string. That work is tracked in elastic/kibana#206221, which is currently a blocked draft with no target date.
This advisory will be updated when an upstream fix becomes consumable.
Status
Status
Fixed version
9.4.6-r1Status