cloudflare / vinext

Wrap all decodeURIComponent calls on user-controlled URL paths in try/catch to return 400 Bad Request instead of throwing an uncaught URIError that crashes the Node process. A single request with a malformed percent-encoded path (e.g. /%E0%A4%A) could terminate the entire server process. This affected all server entry points: prod server (App + Pages Router), dev server middleware, Cloudflare Worker entry, and generated RSC/middleware handlers. Fixes: - prod-server.ts: App Router and Pages Router request handlers - app-router-entry.ts: Cloudflare Worker entry - app-dev-server.ts: Generated RSC entry handler - index.ts: Dev server connect middleware + generated middleware runner + generated NEXT_LOCALE cookie parser - middleware.ts: Pages Router dev middleware runner Includes 11 regression tests across app-router, pages-router, and features test suites.