CVE-2026-45822 affects the decode-uri-component package by SamVerschueren, where the decode() function exhibits super-linear time complexity when parsing inputs containing many '%' tokens. Specifically, the function splits input on '%' producing N tokens and calls decodeComponents(), causing CPU usage to increase disproportionately with input size (e.g., 200 tokens take ~0.7s, 700 tokens ~6s, and 1400 tokens ~33s). This behavior allows an attacker to cause denial of service by crafting inputs that consume excessive CPU and block the event loop.

An attacker can cause significant CPU consumption and event-loop blocking by supplying specially crafted input strings with many '%' tokens to the decode() function. This leads to denial of service conditions in applications using vulnerable versions of decode-uri-component, potentially degrading service availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch is currently documented. Users should monitor the vendor's communications for updates and consider implementing input validation or rate limiting as temporary mitigations to reduce exposure to crafted inputs triggering high CPU usage.