decode-uri-component through 0.4.1 is vulnerable to denial of service. The decode() function splits input on the percent sign, producing many tokens, and calls decodeComponents(), showing super‑linear parsing time: 200 '%ab' tokens take about 0.7s, 700 tokens about 6s, and 1400 tokens about 33s. An attacker can cause significant CPU consumption and event‑loop blocking by submitting crafted input. The primary impact is server resources and stall legitimate requests, affecting availability. The weakness is character‑based input handling leading to resource exhaustion (CWE‑400), poorly bounded loop conditions (CWE‑407), consumption (CWE‑1050).

The vulnerability affects the npm package decode‑uri‑component maintained by SamVerschueren, versions up to and including 0.4.1. Any application that invokes decode() with user‑supplied data inside this range is susceptible.

With a CVSS score of 6.6, the vulnerability is considered moderate severity. The EPSS score of < 1% indicates a very low but non‑zero likelihood of exploitation. The lack of listing in CISA KEV suggests no widespread exploitation yet. The attack vector is likely remote, through web requests or any input channel that the application exposes to untrusted data. An attacker simply needs to send a URI containing an excessive number of percent‑encoded tokens; no authentication or privileged access is required. Because the denial of service can directly impact availability, remediation is critical.