fix(backend): Do not throw URIError when a cookie has a malformed percent-escape

[kev-flex]

Description

Fixes #9333.

ClerkRequest decodes percent-escapes across the whole Cookie header rather than per value, so an invalid sequence in any cookie — including ones Clerk neither set nor reads, such as those written by analytics or third-party scripts — reached decodeURIComponent and threw URIError: URI malformed. The decode runs from the constructor, so the error escaped createClerkRequest and failed the request before any auth logic ran. Because the offending value stays in the browser until it expires, every subsequent request from that client failed too; on @clerk/nextjs this surfaces as a 500 from clerkMiddleware() that the application has no way to catch.

Escape runs that cannot be decoded are now left as their raw text, and the rest of the header parses as before.

Whole-header decoding is deliberately preserved, so the existing behaviour where an escaped ; splits one value into separate cookies (foo=%20bar%3B%20baz%3Dqux → foo=bar, baz=qux) is unchanged and its test still passes.

Covered by tests for the three shapes reported in the issue: truncated sequence (%E2%9), lone continuation byte (%98), and overlong encoding (%C0%80). Each throws on main and passes here.

The lowercase-hex asymmetry also noted in #9333 (%c3%a9 is left raw while %C3%A9 decodes) is intentionally left alone. Fixing it would change parsed cookie values for existing users rather than just stop a crash, so it seems better suited to its own change.

Checklist

• pnpm test runs as expected.
• pnpm build runs as expected.
• (If applicable) JSDoc comments have been added or updated for any package exports
• (If applicable) Documentation has been updated

Type of change

• 🐛 Bug fix
• 🌟 New feature
• 🔨 Breaking change
• 📖 Refactoring / dependency upgrade / documentation
• other:

[vercel]

@kev-flex is attempting to deploy a commit to the Clerk Production Team on Vercel.

A member of the Team first needs to authorize it.

[changeset-bot]

🦋 Changeset detected

Latest commit: e0ac1d2

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 10 packages

Name	Type
@clerk/backend	Patch
@clerk/astro	Patch
@clerk/express	Patch
@clerk/fastify	Patch
@clerk/hono	Patch
@clerk/nextjs	Patch
@clerk/nuxt	Patch
@clerk/react-router	Patch
@clerk/tanstack-react-start	Patch
@clerk/testing	Patch

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Repository YAML (base), Organization UI (inherited)

Review profile: CHILL

Plan: Pro Plus

Run ID: deccf11e-90e7-4dfd-b0ed-f7aec242c760

📥 Commits

Reviewing files that changed from the base of the PR and between f38cf02 and e0ac1d2.

📒 Files selected for processing (3)

• .changeset/kind-rooms-report.md
• packages/backend/src/tokens/__tests__/clerkRequest.test.ts
• packages/backend/src/tokens/clerkRequest.ts

🔗 Linked repositories identified

CodeRabbit considers these linked repositories for cross-repo context during reviews:

• clerk/clerk_go (manual)
• clerk/dashboard (manual)
• clerk/accounts (manual)
• clerk/backoffice (manual)
• clerk/clerk (manual)
• clerk/clerk-docs (manual)
• clerk/cloudflare-workers (manual)

🚧 Files skipped from review as they are similar to previous changes (2)

• packages/backend/src/tokens/tests/clerkRequest.test.ts
• packages/backend/src/tokens/clerkRequest.ts

---

📝 Walkthrough

Walkthrough

decodeCookieValue now handles empty input and catches decoding errors for individual percent-encoded sequences. Malformed cookie values remain unchanged, while valid cookies continue to parse. Regression tests cover request construction, valid-cookie access, truncated sequences, continuation bytes, and overlong encodings. A patch changeset documents the fix.

Estimated code review effort: 2 (Simple) | ~10 minutes

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly identifies the backend bug fix for malformed percent-escapes causing URIError.
Description check	✅ Passed	The description explains the malformed cookie failure, the fix, preserved behavior, tests, and scope decisions.
Linked Issues check	✅ Passed	The implementation prevents URIError for the reported malformed inputs while preserving cookie parsing behavior and adding regression tests [#9333].
Out of Scope Changes check	✅ Passed	The changes are limited to cookie decoding, regression tests, and the related backend changeset.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.

✨ Finishing Touches 💡 1

🛠️ Fix failing CI checks 💡

• Create stacked PR
• Commit on current branch

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

Note

GitHub couldn't provide a complete incremental comparison for this pull request, so CodeRabbit is performing a full review instead. This review may take a little longer.