The original title is about "decode bombs" - URL decoding vulnerabilities. Let me rewrite this as a punchy mobile feed headline.

Short summary

A 'decode bomb' is a resource-exhaustion attack where an attacker sends deeply nested URL-encoded payloads to force a server into excessive decoding loops, similar to a ZIP bomb. The fix is to cap the number of decode passes (e.g., three) rather than looping until the string stops changing, since upstream infrastructure should handle deeply nested encoding anyway. The broader lesson is that every security fix introduces tradeoffs, and developers should evaluate what new risks a fix enables rather than just whether it stops the original attack.

• •Decode bombs exploit unlimited URL-decode loops by sending deeply nested encoded payloads to burn CPU
• •Cap decode passes at a small number (e.g., 3) and rely on upstream infrastructure for deeper encoding
• •Every security fix has side effects — evaluate what new risks each fix introduces

Generated with AI, which can make mistakes.