The decode-uri-component package has a denial of service vulnerability due to quadratic time complexity when processing malformed inputs with many distinct percent-encoded runs. An attacker can craft a payload of about 224 KB that causes the Node.js event loop to block for approximately 20 seconds, making the application unresponsive. This affects version 0.5.0 and earlier. The issue arises because the fallback decoding function performs multiple regex replacements proportional to the number of distinct encoded runs, leading to O(K·L) complexity. The vulnerability impacts availability only, with no confidentiality or integrity effects. It is fixed in version 0.5.1.