SamVerschueren decode-uri-component

• CVE-2026-118664 High 8.2 decode-uri-component: Denial of service via quadratic replacement of percent-encoded runs 0.3%
• CVE-2026-45822 Medium 6.6 decode-uri-component through 0.4.1 is vulnerable to denial of service. The decode() function splits input on '%' producing N tokens and calls decodeComponents(), exhibiting super-linear parsing time: 0.5%