decodePathname throws URIError on malformed percent-encoded pathname #1361

Environment

Node v22.22.0

macos/linux

Reproduction

https://stackblitz.com/edit/node-57djiu9v?file=index.js

node index.js

Describe the bug

decodePathname can throw URIError when the pathname contains malformed percent-encoded bytes (for example incomplete or invalid UTF-8 sequences). This happens during H3Event construction, so the request fails before normal app-level handling can run. This was a breaking change between rc 16 and rc 19 (we stuggle a bit upgrading tanstack TanStack/router#7044 because of it)

Additional context

Adding a try/catch block might be sufficient here to return original pathname on decode failure:

export function decodePathname(pathname: string): string {
  try {
    return decodeURI(
      pathname.includes("%25") ? pathname.replace(/%25/g, "%2525") : pathname,
    );
  } catch {
    return pathname;
  }
}

Logs