GHSA-qr28-fpjm-wq7f - decode-uri-component vulnerable to denial of service via quadratic replacement of percent-encoded runs

### Summary `decodeUriComponent()` takes quadratic time on malformed input that has many distinct percent-encoded runs. A single unauthenticated request of about 224 KB can block the Node.js event loop for about 20 seconds. Version 0.5.0, the release that fixed CVE-2026-45822, is affected. ### Details When native decodeURIComponent throws, `decodeUriComponent()` falls back to `customDecodeURIComponent` (`index.js:122`). That function: 1. Scans the input for every run of percent-encoded bytes (e.g. `%C3%A5`) and stores each distinct run, with its decoded value, in a lookup table (`index.js:130-144`). 2. Runs one full-string `input.replace(new RegExp(key, 'g'), …)` per table entry (`index.js:154`). With K distinct runs in an input of length L, that's K regex compilations and K full scans of the string, so O(K·L). An attacker controls both K and L, and K grows with L. One malformed sequence such as a trailing `%zz` is enough to force the fallback path. The 0.5.0 fix for CVE-2026-45822 (`fa479da`) replaced the recursive `decode()` routine with a linear scanner, but left this replacement loop unchanged. ### Proof of concept Running the following code takes ~20 seconds. ```js import decodeUriComponent from 'decode-uri-component'; let payload = ''; for (let i = 0; i < 32000; i++) { const high = Math.floor(i / 256).toString(16).padStart(2, '0'); const low = (i % 256).toString(16).padStart(2, '0'); payload += `%${high}%${low}x`; // distinct run each iteration } payload += '%zz'; // forces the fallback decoder console.time('decode'); decodeUriComponent(payload); // ~224 KB console.timeEnd('decode'); ``` ### Impact This is an availability issue only and there's no confidentiality or integrity impact. Any application that passes untrusted input to `decodeUriComponent()`, directly or through a dependency such as `query-string`, can be made unresponsive. Because Node.js runs on one thread, one request stalls every other client. The worst case needs input well beyo