CVE-2022-38900 fix for npm v6

[c3ivodujmovic]

[email protected] see GHSA-5698-6q73-gp8h

[c3ivodujmovic]

@wraithgar @ruyadorno what do you guys recommend is the best way to address this issue?

[lukekarrys]

the npm team will audit the vulnerability and create a release for v6 if necessary. currently v6 is only being released with urgent security fixes.

[c3ivodujmovic]

Thanks @lukekarrys . Tell me if there is anything I can help.

Background
High CVE https://nvd.nist.gov/vuln/detail/CVE-2022-38900 Improper Input Validation resulting in DoS
Fixed via decode-uri-component update from 0.2.0 to 0.2.1
The latest node version 14.21.2 (LTS) includes this offending code:
(bash)# npm list decode-uri-component
[email protected] /home/c3/node-v14.21.2-linux-x64/lib/node_modules/npm
└─┬ [email protected]
└── [email protected]

[lukekarrys]

[email protected] was released 2022-12-21 which contains [email protected].

└─┬ [email protected]
  └─┬ [email protected]
    └── [email protected]

There is an open PR to land this change in node 14 which can be followed to track the progress there: nodejs/node#45936