Skip to content

decodePathname throws URIError on malformed percent-encoded pathname #1361

@birkskyum

Description

@birkskyum

Environment

Node v22.22.0

macos/linux

Reproduction

https://stackblitz.com/edit/node-57djiu9v?file=index.js

node index.js

Describe the bug

decodePathname can throw URIError when the pathname contains malformed percent-encoded bytes (for example incomplete or invalid UTF-8 sequences). This happens during H3Event construction, so the request fails before normal app-level handling can run. This was a breaking change between rc 16 and rc 19 (we stuggle a bit upgrading tanstack TanStack/router#7044 because of it)

Additional context

Adding a try/catch block might be sufficient here to return original pathname on decode failure:

export function decodePathname(pathname: string): string {
  try {
    return decodeURI(
      pathname.includes("%25") ? pathname.replace(/%25/g, "%2525") : pathname,
    );
  } catch {
    return pathname;
  }
}

Logs

Metadata

Metadata

Assignees

No one assigned

    Labels

    bugSomething isn't working

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions