Bare percent signs in filenames no longer crash HTTP downloads
The HTTP Request node no longer crashes when downloading files containing a bare `%` character not followed by two hex digits. A fallback now preserves the raw filename when percent-decoding fails.
The HTTP Request node was crashing whenever a server returned a file with a % character in its name that wasn't part of a valid URL-encoded sequence. A filename like my_scan_144dpi_75%.pdf would trigger a URI malformed error, preventing the download entirely — even though the file itself was perfectly valid.
The parsing logic now catches failed percent-decoding attempts and falls back to the raw value instead of throwing. The change also improves how quoted parameter values are handled: quotes are stripped before decoding rather than after, which produces more semantically correct behavior. Parameters containing embedded = characters — common in multipart boundaries like boundary=----WebKit...== — are now parsed correctly using indexOf instead of split. Parameters without a valid = separator are skipped rather than creating malformed entries.
The fix lives in the n8n core package, in the response parsing logic used by the HTTP Request node. Downloads that previously failed will now complete normally.
View Original GitHub Description
Summary
Fixes a URI malformed error thrown by the HTTP Request node when a server responds with a Content-Disposition header containing a filename with a bare % not followed by two hex digits (e.g. attachment; filename="my_scan_144dpi_75%.pdf").
Root cause: parseHeaderParameters() unconditionally called decodeURIComponent() on every header parameter value. A bare % that isn't a valid percent-encoded sequence causes decodeURIComponent to throw. The error only appeared in File and Autodetect response format modes (not Text mode, which skips header parsing).
Changes to parse-incoming-message.ts:
- Strip quotes before attempting to percent-decode, so decoding operates on the actual content rather than the content-with-outer-quotes (more semantically correct)
- Fall back to the raw value when decoding fails, rather than throwing
- Use
indexOf('=')instead ofsplit('=')to correctly parse parameter values that contain=characters (e.g.boundary=----WebKit...==,filename="report=final.pdf") - Skip malformed parameters that have no
=(previously silently injected{'': 'undefined'}into the parsed result viadecodeURIComponent(undefined)coercion)
Backward-compatible: non-standard quoted+percent-encoded filenames (e.g. filename="screenshot%20(1).png") continue to decode correctly.
Related Linear tickets, Github issues, and Community forum posts
https://linear.app/n8n/issue/NODE-4618 fixes #26031
Review / Merge checklist
- PR title and summary are descriptive. (conventions)
- Docs updated or follow-up ticket created.
- Tests included.
- PR Labeled with
release/backport(if the PR is an urgent fix that needs to be backported)