[rseligm2]

Malformed input with many distinct valid percent-encoded runs still causes quadratic work after the 0.5.0 scanner fix. customDecodeURIComponent scans the full input once for each replacement-map key. The new regression uses 60,000 distinct runs and one invalid byte; the current release exceeds the child process's 3-second limit.

Replace the map with one callback per original percent run. Keep UTF-16 BOM and truncated %C2 handling in the scanner, so they apply to the original input. This also corrects two malformed-input cases: decoded dollar patterns are inserted literally, and decoded percent signs cannot create a second escape to decode. Valid input and the existing CommonJS-independent API remain unchanged.

Validation: npm test passes XO, 137 AVA tests, and TSD. The regression checks the full decoded value, bounds work in a child process, and covers repeated invalid bytes and long valid runs followed by a lone percent sign. Existing BOM, truncated %C2, Unicode, and type tests pass.

[SamVerschueren]

This security issue reached to me via Tidelift. I've published version 0.5.1 with a fix together with the security advisory GHSA-qr28-fpjm-wq7f.