[GHSA] GHSA-vcc3-ghjq-m6fr (medium) — decode-uri-component: Denial of service via exponential decoding of malformed percent-encoded input

GHSA-vcc3-ghjq-m6fr Severity: medium CVE: CVE-2026-45822

decode-uri-component: Denial of service via exponential decoding of malformed percent-encoded input

### Impact An attacker who can supply input to `decodeUriComponent()` (directly or via a dependency that uses this package on URL/query/path data) can cause excessive CPU usage and application unresponsiveness. This is an availability issue;