URL Parsing Error Due to Newline Character Inclusion

[welkinwong]

I'm using React Router as a...

library

Reproduction

When a URL contains a newline character (either as %0a), the system throws an error but fails to properly handle it in the routing layer.

example:
https://reactrouter.com/home/%0a

System Info

System:
    OS: macOS 15.4.1
    CPU: (10) arm64 Apple M2 Pro
    Memory: 104.27 MB / 16.00 GB
    Shell: 5.9 - /bin/zsh
  Binaries:
    Node: 23.10.0 - /opt/homebrew/opt/node/bin/node
    npm: 10.9.2 - /opt/homebrew/opt/node/bin/npm
    pnpm: 10.5.2 - /opt/homebrew/bin/pnpm
  Browsers:
    Chrome: 135.0.7049.115
    Safari: 18.4
  npmPackages:
    react-router: ^7.5.3 => 7.5.3

Used Package Manager

npm

Expected Behavior

Caught by wildcard route (for 404 pages)

Actual Behavior

throws a server error

[timdorr]

I'm getting this as an Error: No route matches URL "/%0a" when I try this locally. That is coming through as a server error, so it displays that generic one in production mode.

[welkinwong]

@timdorr Yes, but normally it should be captured by the '*' wildcard, leading to a 404 page.

like this:

[timdorr]

I know, I'm just giving more context than the obfuscated error on the reactrouter.com site.

[rururux]

Maybe this is the part that is causing the problem.

[rururux]

It seems that this can be fixed by adding the s (single line) flag to the regular expression created by compilePath(), but is there any possibility that adding the s flag will have some side effects?