URIError: URI malformed — ClerkRequest.parseCookies throws on any malformed percent-escape in the Cookie header

Important limitations

• This may be one public report, not widespread demand.
• Current independent report count: 1.
• This is currently a single independent report. It has not passed clustering or human review as a verified signal.
• No market size, willingness to pay, competition, or trend claims are inferred here.

What was reported

Who is affected

Application developer using the reported software

Job to be done

Build an application reliably

Workflow

**Present in the latest release.** The code above is current on `main`, and the published build is the same: [`@clerk/backend@3.15.1/dist/internal.js`](https://cdn.jsdelivr.net/npm/@clerk/backend@3.15.1/dist/internal.js) lines 7007-7013.

Desired outcome

A cookie unrelated to Clerk should not be able to fail the request.

Severity

Not enough evidence yet.

Urgency

Not enough evidence yet.

Evidence indicators

What would upgrade this

• Additional independent reports from distinct communities or authors.
• Human clustering into a review signal, then explicit publication approval.
• Counter-evidence review and durable original-source verification.

Original source

Open the original public report