High [CVE-2026-45822] Denial of Service via crafted input

decode-uri-component through 0.4.1 is vulnerable to denial of service. The decode() function splits input on '%' producing N tokens and calls decodeComponents(), exhibiting super-linear parsing time: 200 '%ab' tokens takes approximately 0.7s, 700 tokens approximately 6s, and 1400 tokens approximately 33s.

An attacker can cause significant CPU consumption and event-loop blocking via crafted input. A flaw was found in the `decode-uri-component` library.

This vulnerability allows a remote attacker to trigger a Denial of Service (DoS) by submitting specially crafted input. The `decode()` function, when processing a large number of encoded URI components, consumes excessive CPU resources, which can lead to the application becoming unresponsive and unavailable.

In Red Hat products where this package is bundled (OpenShift Console, Quay, Pipelines, RHOAI, and others), exploitation requires that attacker-controlled input containing crafted percent-encoded strings reaches the decode() function without prior length validation.

Red Hat rates this as Moderate severity since the impact is limited to availability with no confidentiality or integrity impact, consistent with the CNA's CVSS 4.0 assessment of 6.6 Medium. Weakness: CWE-1050.

Affected products named by the advisory: Red Hat Migration Toolkit 1.8; Red Hat Quay 3.10; Red Hat Quay 3.12; Red Hat Quay 3.15; and 7 more.