An unauthenticated attacker can cause a denial of service by supplying a long malformed PEM message to any high-level parser. This occurs because the `pem.decode()` function in `lib/pem.js` uses polynomial-time regular expressions when parsing encapsulated headers and searching for a matching END line, leading to excessive CPU consumption.