') + ')', 'gi'); if (regex.test(text)) { found = true; var frag = document.createDocumentFragment(); var parts = text.split(regex); parts.forEach(function(part, i) { if (i % 2 === 0) { frag.appendChild(document.createTextNode(part)); } else { var span = document.createElement('span'); span.className = 'userscript-highlight'; span.textContent = part; frag.appendChild(span); } }); node.parentNode.replaceChild(frag, node); } }); } else if (node.nodeType === 1 && node.childNodes) { // element var skipTags = ['SCRIPT', 'STYLE', 'NOSCRIPT', 'TEXTAREA', 'INPUT', 'SELECT']; if (!skipTags.includes(node.tagName)) { Array.from(node.childNodes).forEach(highlight); } } } highlight(document.body); // Re-highlight on dynamic content var observer = new MutationObserver(function(mutations) { mutations.forEach(function(m) { m.addedNodes.forEach(function(node) { if (node.nodeType === 1 || node.nodeType === 3) highlight(node); }); }); }); observer.observe(document.body, { childList: true, subtree: true }); })(); } } catch(__e) { console.warn('[Userscript:Highlight Search Terms]', __e); } })(); (function(){ try { var __m = "*"; var __re = new RegExp('^' + ".*" + ', 'i'); if (__m === '*' || __re.test(location.href)) { // Strip utm_, fbclid, gclid, etc. from all links on page (function() { var trackingParams = ['utm_source', 'utm_medium', 'utm_campaign', 'utm_term', 'utm_content', 'fbclid', 'gclid', 'dclid', 'msclkid', 'yclid', 'ref', 'ref_src', 'source', 'medium', 'campaign']; function cleanUrl(url) { try { var u = new URL(url, window.location.origin); var changed = false; trackingParams.forEach(function(p) { if (u.searchParams.has(p)) { u.searchParams.delete(p); changed = true; } }); return changed ? u.toString() : url; } catch (e) { return url; } } function cleanLinks() { document.querySelectorAll('a[href]').forEach(function(a) { var clean = cleanUrl(a.href); if (clean !== a.href) a.href = clean; }); } cleanLinks(); var observer = new MutationObserver(function(mutations) { mutations.forEach(function(m) { m.addedNodes.forEach(function(node) { if (node.nodeType === 1) { if (node.tagName === 'A') cleanLinks(); node.querySelectorAll('a[href]').forEach(function(a) { var clean = cleanUrl(a.href); if (clean !== a.href) a.href = clean; }); } }); }); }); observer.observe(document.body, { childList: true, subtree: true }); })(); } } catch(__e) { console.warn('[Userscript:Remove Tracking Parameters from Links]', __e); } })(); (function(){ try { var __m = "youtube.com"; var __re = new RegExp('^' + "youtube\\.com" + ', 'i'); if (__m === '*' || __re.test(location.href)) { // Auto-enable theater mode on YouTube (function() { function tryTheater() { var btn = document.querySelector('button[aria-label="Theater mode"], ytd-player #player button[title="Theater mode"]'); if (btn && !btn.classList.contains('activated')) { btn.click(); } } // Try immediately tryTheater(); // Try after navigation (SPA) var lastUrl = location.href; setInterval(function() { if (location.href !== lastUrl) { lastUrl = location.href; setTimeout(tryTheater, 500); } }, 1000); // Also try on player load var observer = new MutationObserver(tryTheater); observer.observe(document.body, { childList: true, subtree: true }); })(); } } catch(__e) { console.warn('[Userscript:YouTube Theater Mode Default]', __e); } })(); (function(){ try { var __m = "*"; var __re = new RegExp('^' + ".*" + ', 'i'); if (__m === '*' || __re.test(location.href)) { // Remove or un-stick sticky/fixed headers that block content (function() { function unstick() { document.querySelectorAll('header, nav, [role="banner"], .header, .navbar, .sticky, .fixed-top, [style*="position: fixed"], [style*="position:sticky"]').forEach(function(el) { if (el.style.position === 'fixed' || el.style.position === 'sticky' || getComputedStyle(el).position === 'fixed' || getComputedStyle(el).position === 'sticky') { el.style.position = 'static'; el.style.top = 'auto'; el.style.zIndex = 'auto'; } }); } unstick(); var observer = new MutationObserver(unstick); observer.observe(document.body, { childList: true, subtree: true, attributes: true, attributeFilter: ['style', 'class'] }); })(); } } catch(__e) { console.warn('[Userscript:Kill Sticky Headers]', __e); } })(); })(); Uncaught "URI malformed" error in baggageHeaderToObject due to invalid percent-encoding in baggage header · Issue #16251 · getsentry/sentry-javascript · GitHub
Skip to content

Uncaught "URI malformed" error in baggageHeaderToObject due to invalid percent-encoding in baggage header #16251

Closed
#16257
Closed
Uncaught "URI malformed" error in baggageHeaderToObject due to invalid percent-encoding in baggage header#16251
#16257
Assignees
mydea
Labels
BugFastify

Description

@roman-antl-satoshilabs
roman-antl-satoshilabs
opened on May 12, 2025

Is there an existing issue for this?

How do you use Sentry?

Self-hosted/on-premise

Which SDK are you using?

@sentry/node - fastify

SDK Version

9.17.0

Framework Version

node.js

Link to Sentry event

No response

Reproduction Example/SDK Setup

Description:
When the Sentry SDK for Node.js receives a request with an invalid baggage header (containing malformed percent-encoding, e.g. %3G or %4Z), it throws an uncaught URIError: URI malformed exception. This happens because using function decodeURIComponent in baggageHeaderToObject

This causes the entire Node.js process (e.g. Fastify server) to crash before any application-level error handling or middleware can run, making it impossible to sanitize or ignore the header at the application level.

Relevant Code:
Link here

Additional Context:

This issue cannot be worked around at the application level, since Sentry parses the header before any framework middleware or hooks are executed.
The only current workaround is to filter the header at the proxy/load balancer level, which is not always possible.
This can be exploited to cause a denial of service by sending malformed headers.

Steps to Reproduce

  1. Start a Node.js server with Sentry SDK enabled (e.g. Fastify, Express).
  2. Send a request with a baggage header containing invalid percent-encoding, e.g.: %20%3G%4Z
  3. Observe that the server crashes with a URIError: URI malformed originating from Sentry.

Expected Result

Sentry should gracefully handle invalid percent-encoding in the baggage header. Ideally, it should:

Ignore or skip invalid key-value pairs in the header.
Not crash the process.
Optionally log a warning or report the malformed header as a non-fatal event.

Actual Result

The process crashes with an uncaught exception:

URIError: URI malformed
at decodeURIComponent (<anonymous>)
at baggageHeaderToObject (.../sentry-javascript/packages/core/src/utils-hoist/baggage.ts:116:32)
...

Metadata

Metadata

Assignees

Labels

BugFastify

Projects

GitHub Issues with 👀 3
Status
No status

Milestone

No milestone

Relationships

None yet

Development

No branches or pull requests

Issue actions