decode-uri-component vulnerable to denial of service via quadratic replacement of percent-encoded runs

• <= 0.5.0

### Summary `decodeUriComponent()` takes quadratic time on malformed input that has many distinct percent-encoded runs. A single unauthenticated request of about 224 KB can block the Node.js event loop for about 20 seconds. Version 0.5.0, the release that fixed CVE-2026-45822, is affected. ### Details When native decodeURIComponent throws, `decodeUriComponent()` falls back to `customDecodeURIComponent` (`index.js:122`). That function: 1. Scans the input for every run of percent-encoded bytes (e.g. `%C3%A5`) and stores each distinct run, with its decoded value, in a lookup table (`index.js:130-144`). 2. Runs one full-string `input.replace(new RegExp(key, 'g'), …)` per table entry (`index.js:154`). With K distinct runs in an input of length L, that's K regex compilations and K full scans of the string, so O(K·L). An attacker controls both K and L, and K grows with L. One malformed sequence such as a trailing `%zz` is enough to force the fallback path. The 0.5.0 fix for CVE-2026-45822 (`fa479da`) replaced the recursive `decode()` routine with a linear scanner, but left this replacement loop unchanged. ### Proof of concept Running the following code takes ~20 seconds. ```js imp

GitHub Advisory Database

• SEMVER: introduced 0; fixed 0.5.1

### Summary `decodeUriComponent()` takes quadratic time on malformed input that has many distinct percent-encoded runs. A single unauthenticated request of about 224 KB can block the Node.js event loop for about 20 seconds. Version 0.5.0, the release that fixed CVE-2026-45822, is affected. ### Details When native decodeURIComponent throws, `decodeUriComponent()` falls back to `customDecodeURIComponent` (`index.js:122`). That function: 1. Scans the input for every run of percent-encoded bytes (e.g. `%C3%A5`) and stores each distinct run, with its decoded value, in a lookup table (`index.js:130-144`). 2. Runs one full-string `input.replace(new RegExp(key, 'g'), …)` per table entry (`index.js:154`). With K distinct runs in an input of length L, that's K regex compilations and K full scans of the string, so O(K·L). An attacker controls both K and L, and K grows with L. One malformed sequence such as a trailing `%zz` is enough to force the fallback path. The 0.5.0 fix for CVE-2026-45822 (`fa479da`) replaced the recursive `decode()` routine with a linear scanner, but left this replacement loop unchanged. ### Proof of concept Running the following code takes ~20 seconds. ```js imp

GitHub Advisory Database via OSV