Skip to content

Conversation

@jpreynat
Copy link
Member

Some requests are currently failing when receiving either invalid or spam requests for page params that include invalid characters.

Our current code to extract the params uses decodeURIComponent without any safeguard, leading to crashing the whole Node process, which is even more problematic with fluid computing on Vercel.

This PR prevents this problem by returning a 404 Not found on such requests on decoding errors.

@jpreynat jpreynat self-assigned this Dec 11, 2025
@changeset-bot
Copy link

changeset-bot bot commented Dec 11, 2025

⚠️ No Changeset found

Latest commit: ee404e7

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

@argos-ci
Copy link

argos-ci bot commented Dec 11, 2025

The latest updates on your projects. Learn more about Argos notifications ↗︎

Build Status Details Updated (UTC)
customers-v2 (Inspect) 👍 Changes approved 1 changed Dec 12, 2025, 12:10 PM
v2-cloudflare (Inspect) 👍 Changes approved 15 changed Dec 12, 2025, 12:15 PM
v2-vercel (Inspect) 👍 Changes approved 41 changed Dec 12, 2025, 12:15 PM

Copy link
Contributor

@conico974 conico974 left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The PR itself is good, but I don't think this is the real issue. If you throw in any of these locally it won't crash the Node process.
The problem is in Vercel (or Next minimal mode, not sure which one), nothing of what we do is supposed to crash the entire Node process

@jpreynat jpreynat merged commit 2d08a6e into main Dec 12, 2025
16 checks passed
@jpreynat jpreynat deleted the 404-on-decode-uri-error branch December 12, 2025 12:27
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants