CVE-2022-38900 fix for npm v6

[c3ivodujmovic]

query-string@7.1.3 see GHSA-5698-6q73-gp8h

[c3ivodujmovic]

@wraithgar @ruyadorno what do you guys recommend is the best way to address this issue?

[lukekarrys]

the npm team will audit the vulnerability and create a release for v6 if necessary. currently v6 is only being released with urgent security fixes.

[c3ivodujmovic]

Thanks @lukekarrys . Tell me if there is anything I can help.

Background
High CVE https://nvd.nist.gov/vuln/detail/CVE-2022-38900 Improper Input Validation resulting in DoS
Fixed via decode-uri-component update from 0.2.0 to 0.2.1
The latest node version 14.21.2 (LTS) includes this offending code:
(bash)# npm list decode-uri-component
npm@6.14.17 /home/c3/node-v14.21.2-linux-x64/lib/node_modules/npm
└─┬ query-string@6.8.2
└── decode-uri-component@0.2.0

[lukekarrys]

npm@6.14.18 was released 2022-12-21 which contains decode-uri-component@0.2.2.

└─┬ npm@6.14.18
  └─┬ query-string@6.14.1
    └── decode-uri-component@0.2.2

There is an open PR to land this change in node 14 which can be followed to track the progress there: nodejs/node#45936