From b1fcee2a0df608d3d162d85209e5788c3ebde06e Mon Sep 17 00:00:00 2001
From: Sheraff <me@florianpellet.com>
Date: Fri, 21 Aug 2026 23:45:37 +0200
Subject: [PATCH] fix(router-core): harden string encoding/decoding boundaries

Centralize all URL-path encoding/decoding primitives in a single
string-encoding module with trust-boundary documentation, branded
string kinds, and ESLint enforcement banning raw encodeURIComponent/
decodeURI*/btoa/atob elsewhere.

Fixes a real crash: malformed percent-encoding (e.g. /post/%E4%BD)
threw URIError out of extractParams through findFlatMatch (route
masks) and findSingleMatch (router.matchRoute), which had no guard.
findMatch is now the single choke point converting URIError into a
null match (404), byte-neutral vs the previous per-caller guard.

Adds fast-check property-based and concrete security tests for every
encoding surface identified in docs/string-handling.md:
- matcher totality, path param round-trips, open-redirect defense
- search-param parse safety, null prototypes, JSON coercion contract
- SSR inline-script XSS resistance (adversarial scroll-restoration
  keys) and seroval factory interpolation canary
- frame protocol round-trips and client frame-decoder DoS limits
- server-fn payload handling (size cap, method check, context merge,
  malformed input)
- virtual-module base64url ID round-trips and hostile payload fallbacks
- early-hints Link-header injection resistance and prerender SSRF

Documents known quirks (legacy '*' splat collision, search-param JSON
coercion, early-hints href interpolation) instead of silently changing
behavior.
---
 .changeset/brave-strings-harden.md            |   8 +
 packages/router-core/docs/string-handling.md  |  97 +++++++
 packages/router-core/eslint.config.js         |  86 ++++++
 packages/router-core/package.json             |  11 +-
 packages/router-core/src/index.ts             |   3 +-
 .../router-core/src/new-process-route-tree.ts |  51 ++--
 packages/router-core/src/path.ts              |  51 ++--
 packages/router-core/src/router.ts            |  18 +-
 .../src/scroll-restoration-script/server.ts   |   2 +-
 packages/router-core/src/ssr/ssr-server.ts    |   2 +-
 packages/router-core/src/string-encoding.ts   | 183 ++++++++++++
 packages/router-core/src/utils.ts             | 148 ----------
 .../tests/malformed-percent.test.ts           | 136 +++++++++
 packages/router-core/tests/path.test.ts       |   2 +-
 .../tests/search-params.property.test.ts      |  86 ++++++
 .../router-core/tests/ssr-injection.test.ts   | 128 +++++++++
 .../tests/string-encoding.bench.ts            |  84 ++++++
 .../tests/string-encoding.property.test.ts    | 250 ++++++++++++++++
 packages/router-core/tests/utils.test.ts      |   6 +-
 packages/start-client-core/package.json       |  11 +-
 .../src/tests/frame-decoder.test.ts           | 144 ++++++++++
 packages/start-plugin-core/package.json       |  11 +-
 .../virtualModules-roundtrip.test.ts          | 159 +++++++++++
 .../tests/prerender-ssrf.test.ts              |  37 +++
 packages/start-server-core/package.json       |  13 +-
 .../tests/early-hints-hardening.test.ts       |  86 ++++++
 .../tests/server-functions-handler.test.ts    | 266 ++++++++++++++++++
 pnpm-lock.yaml                                |  64 +++--
 28 files changed, 1875 insertions(+), 268 deletions(-)
 create mode 100644 .changeset/brave-strings-harden.md
 create mode 100644 packages/router-core/docs/string-handling.md
 create mode 100644 packages/router-core/src/string-encoding.ts
 create mode 100644 packages/router-core/tests/malformed-percent.test.ts
 create mode 100644 packages/router-core/tests/search-params.property.test.ts
 create mode 100644 packages/router-core/tests/ssr-injection.test.ts
 create mode 100644 packages/router-core/tests/string-encoding.bench.ts
 create mode 100644 packages/router-core/tests/string-encoding.property.test.ts
 create mode 100644 packages/start-client-core/src/tests/frame-decoder.test.ts
 create mode 100644 packages/start-plugin-core/tests/importProtection/virtualModules-roundtrip.test.ts
 create mode 100644 packages/start-server-core/tests/early-hints-hardening.test.ts
 create mode 100644 packages/start-server-core/tests/server-functions-handler.test.ts

diff --git a/.changeset/brave-strings-harden.md b/.changeset/brave-strings-harden.md
new file mode 100644
index 00000000000..1b5be7c484d
--- /dev/null
+++ b/.changeset/brave-strings-harden.md
@@ -0,0 +1,8 @@
+---
+'@tanstack/router-core': patch
+'@tanstack/start-client-core': patch
+'@tanstack/start-plugin-core': patch
+'@tanstack/start-server-core': patch
+---
+
+harden string encoding/decoding: centralize URL-path primitives, fix URIError escape via route masks and matchRoute, add property-based and security tests across SSR scripts, frame protocol, server-fn payloads, virtual-module IDs and early hints
diff --git a/packages/router-core/docs/string-handling.md b/packages/router-core/docs/string-handling.md
new file mode 100644
index 00000000000..29b5b19eaf3
--- /dev/null
+++ b/packages/router-core/docs/string-handling.md
@@ -0,0 +1,97 @@
+# String handling in TanStack Router
+
+All URL-path string encoding/decoding primitives live in
+`router-core/src/string-encoding.ts`. ESLint (`no-restricted-globals` in that
+package's eslint config) bans direct use of `encodeURIComponent`,
+`decodeURIComponent`, `encodeURI`, `decodeURI`, `btoa` and `atob` anywhere else
+in router-core `src/` (with two documented exceptions).
+
+## Scope map: every encoding surface and where its guarantees are tested
+
+| #   | Surface                                   | Package / file                                                                   | Tests                                                                            |
+| --- | ----------------------------------------- | -------------------------------------------------------------------------------- | -------------------------------------------------------------------------------- |
+| 1   | URL path encode-on-write                  | `router-core/src/string-encoding.ts` (`encodePathParam`, `compileDecodeCharMap`) | `string-encoding.property.test.ts`, `path.test.ts`                               |
+| 1   | href encoding                             | `encodePathLikeUrl`, `buildDevStylesUrl`                                         | `utils.test.ts`, property tests                                                  |
+| 2   | URL path decode-on-read (attacker input)  | `decodePath`/`decodeSegment`; matcher `decodeParam` + `findMatch` choke point    | `malformed-percent.test.ts`, `string-encoding.property.test.ts`, `utils.test.ts` |
+| 2   | prerender page validation (SSRF)          | `start-plugin-core/src/prerender.ts`                                             | `prerender-ssrf.test.ts`                                                         |
+| 3   | search params                             | `router-core/src/qss.ts`, `searchParams.ts`                                      | `search-params.property.test.ts`                                                 |
+| 4   | SSR inline scripts (XSS)                  | `escapeHtml` + scroll-restoration script; seroval stream factories               | `ssr-injection.test.ts`, `string-encoding.property.test.ts`                      |
+| 5   | binary ↔ string (SSR streams, RPC frames) | `RawStream.ts`, `frame-protocol.ts`, client `frame-decoder.ts`                   | `frame-protocol.test.ts`, `frame-decoder.test.ts`                                |
+| 6   | server-fn payload deserialization         | `start-server-core/server-functions-handler.ts`                                  | `server-functions-handler.test.ts`                                               |
+| 7   | build-time base64url module IDs           | `start-plugin-core/import-protection/virtualModules.ts` (+rsbuild twin)          | `virtualModules-roundtrip.test.ts`                                               |
+| 8   | persistence & headers                     | scroll-restoration JSON guards; early-hints Link headers                         | `scroll-restoration*.test.ts`, `early-hints-hardening.test.ts`                   |
+
+## Trust boundaries and guarantees
+
+| Function            | Input trust                         | Guarantee                                                                                                                |
+| ------------------- | ----------------------------------- | ------------------------------------------------------------------------------------------------------------------------ |
+| `decodePath`        | attacker-controlled (URL)           | total: never throws; strips control chars, `"`, `<`, `>`, backtick, braces; collapses protocol-relative prefixes         |
+| `encodePathParam`   | app data (params)                   | output safe for embedding in a single path segment                                                                       |
+| `escapeHtml`        | app data (may contain user content) | output cannot break out of `<script>` text context                                                                       |
+| `encodePathLikeUrl` | internally-decoded paths            | output contains no whitespace or non-ASCII characters; not fully encoded (ASCII specials pass through), hence unbranded  |
+| `buildDevStylesUrl` | dev-only, internal route IDs        | n/a                                                                                                                      |
+| frame decoder       | network bytes                       | size/count caps (16MiB/frame, 32MiB buffer, 1024 streams, 100k frames); unknown types and convention violations rejected |
+
+## Malformed percent-encoding policy
+
+A URL segment with malformed percent-encoding (e.g. `/post/%E4%BD`, `/post/%zz`,
+`/post/%`) must never crash the router.
+
+- `decodeParam` (string-encoding.ts) throws `URIError` on malformed input.
+- `findMatch` (new-process-route-tree.ts) is the **single choke point** that
+  converts that `URIError` into "no match". Every public matching entry point
+  (`findRouteMatch`, `findFlatMatch`, `findSingleMatch`) funnels through it.
+- Totality of all entry points is enforced by
+  `tests/string-encoding.property.test.ts`; concrete regressions live in
+  `tests/malformed-percent.test.ts`.
+- The ESLint exception that permits `decodeParam` to exist is
+  `tanstack/router-core/matching-decode-contract` in eslint.config.js.
+
+## Branded string kinds
+
+Percent-encoding is not idempotent: confusing an encoded string for a decoded one
+produces double-encoded URLs, and vice versa. The brands make kinds distinct at
+type level; they are erased at runtime (zero bundle cost) and extend `string`, so
+consuming plain-string APIs stays free:
+
+| Type               | Produced by       | Meaning                                   |
+| ------------------ | ----------------- | ----------------------------------------- |
+| `EncodedPathParam` | `encodePathParam` | percent-encoded single path-segment value |
+| `DecodedPathParam` | `decodeParam`     | decoded param value extracted from a URL  |
+| `EncodedPath`      | `interpolatePath` | full path with all params encoded         |
+| `DecodedPath`      | `decodePath`      | decoded pathname (`location.pathname`)    |
+
+`compileDecodeCharMap`'s decoder receives `EncodedPathParam`: custom decoders are
+handed values produced by `encodeURIComponent` and may contain `%XX` sequences.
+
+## Known issues / quirks (documented, deliberately not "fixed")
+
+### `*` splat value collides with legacy wildcard syntax
+
+A splat param value of `*` interpolates to `/files/*` — which is itself the legacy
+wildcard syntax. Matching such a URL resolves to the legacy route node with empty
+params instead of the `$` splat route carrying `_splat: '*'`. Reproduced in
+`tests/malformed-percent.test.ts`. Fixing it requires encoding `*` as `%2A` in
+splat interpolation _and_ preserving `%2A` through `decodePath` (alongside `%25`
+/`%5C`); the latter changes static-segment matching for paths containing literal
+encoded asterisks, so it needs dedicated e2e coverage before attempting.
+
+### Search-param JSON coercion
+
+The default search parser JSON-parses any value that could start valid JSON, so a
+plain string `' 42'`, `'true'` or `'[1]'` changes type across a read. Long-standing
+designed behavior; pinned in `search-params.property.test.ts`. Apps needing exact
+strings must use custom search serialization.
+
+### Early-hints `href` interpolation
+
+`serializeEarlyHint` interpolates `href` verbatim between `<...>`. Attribute
+values are injection-proof (token allowlist or quoted-string), but href comes
+from the asset manifest — if user data ever reaches it, escaping must be added.
+Pinned in `early-hints-hardening.test.ts`.
+
+### Server-fn wire format
+
+Server-function payloads are seroval JSON, not plain JSON. Plain JSON in a POST
+body yields a 500 with the seroval error serialized — intentional (matches how
+errors are surfaced elsewhere); covered in `server-functions-handler.test.ts`.
diff --git a/packages/router-core/eslint.config.js b/packages/router-core/eslint.config.js
index ca29e6c97bd..e979e462cac 100644
--- a/packages/router-core/eslint.config.js
+++ b/packages/router-core/eslint.config.js
@@ -10,4 +10,90 @@ export default [
       '@typescript-eslint/no-unnecessary-condition': 'off',
     },
   },
+  {
+    // All URL-path string encoding/decoding must go through src/string-encoding.ts
+    // so its guarantees (totality, sanitization, XSS safety) are enforced in one
+    // reviewed place. See the trust-boundary documentation in that module.
+    name: 'tanstack/router-core/string-encoding-boundary',
+    files: ['src/**/*.ts'],
+    ignores: ['src/string-encoding.ts'],
+    rules: {
+      'no-restricted-globals': [
+        'error',
+        {
+          name: 'encodeURIComponent',
+          message: 'Use encodePathParam from ./string-encoding instead.',
+        },
+        {
+          name: 'decodeURIComponent',
+          message: 'Decoding must go through ./string-encoding helpers instead.',
+        },
+        {
+          name: 'encodeURI',
+          message: 'Use helpers from ./string-encoding instead.',
+        },
+        {
+          name: 'decodeURI',
+          message:
+            'Decoding must go through decodePath/decodeSegment in ./string-encoding.',
+        },
+        {
+          name: 'btoa',
+          message:
+            'Binary encoding belongs in ssr/serializer; ask before adding new uses.',
+        },
+        {
+          name: 'atob',
+          message:
+            'Binary decoding belongs in ssr/serializer; ask before adding new uses.',
+        },
+      ],
+    },
+  },
+  {
+    // Exception to the rule above: in the matcher, throwing URIError from
+    // decodeParam is the documented "malformed percent-encoding = no match"
+    // contract. findMatch is the single choke point that converts it into a
+    // null match; every public matching entry point funnels through it and
+    // tests/string-encoding.property.test.ts asserts their totality.
+    name: 'tanstack/router-core/matching-decode-contract',
+    files: ['src/new-process-route-tree.ts'],
+    rules: {
+      'no-restricted-globals': [
+        'error',
+        {
+          name: 'encodeURIComponent',
+          message: 'Use encodePathParam from ./string-encoding instead.',
+        },
+        {
+          name: 'encodeURI',
+          message: 'Use helpers from ./string-encoding instead.',
+        },
+        {
+          name: 'decodeURI',
+          message:
+            'Decoding must go through decodePath/decodeSegment in ./string-encoding.',
+        },
+        {
+          name: 'btoa',
+          message:
+            'Binary encoding belongs in ssr/serializer; ask before adding new uses.',
+        },
+        {
+          name: 'atob',
+          message:
+            'Binary decoding belongs in ssr/serializer; ask before adding new uses.',
+        },
+      ],
+    },
+  },
+  {
+    // Base64 lives canonically in ssr/serializer (SSR stream serialization);
+    // URL-path primitives live in string-encoding.ts.
+    name: 'tanstack/router-core/binary-encoding-boundary',
+    files: ['src/ssr/serializer/**/*.ts', 'src/string-encoding.ts'],
+    rules: {
+      'no-restricted-globals': 'off',
+    },
+  },
 ]
diff --git a/packages/router-core/package.json b/packages/router-core/package.json
index 88798f1bc62..bec27311c96 100644
--- a/packages/router-core/package.json
+++ b/packages/router-core/package.json
@@ -188,15 +188,16 @@
     "seroval-plugins": "^1.6.2"
   },
   "devDependencies": {
+    "@arethetypeswrong/cli": "catalog:",
     "@tanstack/store": "^0.9.3",
+    "@tanstack/vite-config": "catalog:",
     "@types/node": "25.0.9",
     "esbuild": "^0.27.4",
-    "vite": "catalog:",
-    "@tanstack/vite-config": "catalog:",
-    "vitest": "catalog:",
+    "fast-check": "^4.9.0",
     "jsdom": "catalog:",
-    "@arethetypeswrong/cli": "catalog:",
     "publint": "catalog:",
-    "rimraf": "catalog:"
+    "rimraf": "catalog:",
+    "vite": "catalog:",
+    "vitest": "catalog:"
   }
 }
diff --git a/packages/router-core/src/index.ts b/packages/router-core/src/index.ts
index a296629ffa3..eb1c4869a46 100644
--- a/packages/router-core/src/index.ts
+++ b/packages/router-core/src/index.ts
@@ -316,10 +316,9 @@ export {
   createControlledPromise,
   isModuleNotFoundError,
   DEFAULT_PROTOCOL_ALLOWLIST,
-  escapeHtml,
   isDangerousProtocol,
-  buildDevStylesUrl,
 } from './utils'
+export { buildDevStylesUrl, escapeHtml } from './string-encoding'
 export type {
   NoInfer,
   IsAny,
diff --git a/packages/router-core/src/new-process-route-tree.ts b/packages/router-core/src/new-process-route-tree.ts
index 0baf6930421..63df9775251 100644
--- a/packages/router-core/src/new-process-route-tree.ts
+++ b/packages/router-core/src/new-process-route-tree.ts
@@ -1,5 +1,6 @@
 import { invariant } from './invariant'
 import { createLRUCache } from './lru-cache'
+import { decodeParam } from './string-encoding'
 import { last } from './utils'
 import type { LRUCache } from './lru-cache'
 
@@ -633,21 +634,11 @@ export function findRouteMatch<
   const cached = processedTree.matchCache.get(key)
   if (cached !== undefined) return cached
   path ||= '/'
-  let result: RouteMatch<T> | null
-
-  try {
-    result = findMatch(
-      path,
-      processedTree.segmentTree,
-      fuzzy,
-    ) as RouteMatch<T> | null
-  } catch (err) {
-    if (err instanceof URIError) {
-      result = null
-    } else {
-      throw err
-    }
-  }
+  const result = findMatch(
+    path,
+    processedTree.segmentTree,
+    fuzzy,
+  ) as RouteMatch<T> | null
 
   if (result) result.branch = buildRouteBranch(result.route)
   processedTree.matchCache.set(key, result)
@@ -753,12 +744,20 @@ function findMatch<T extends RouteLike>(
   rawParams: Record<string, string>
 } | null {
   const parts = path.split('/')
-  const leaf = getNodeMatch(path, parts, segmentTree, fuzzy)
-  if (!leaf) return null
-  const [rawParams] = extractParams(path, parts, leaf)
-  return {
-    route: leaf.node.route!,
-    rawParams,
+  // extractParams throws URIError when a param value contains malformed
+  // percent-encoding. This is the single choke point that converts that into
+  // "no match" — all public matching entry points funnel through here.
+  try {
+    const leaf = getNodeMatch(path, parts, segmentTree, fuzzy)
+    if (!leaf) return null
+    const [rawParams] = extractParams(path, parts, leaf)
+    return {
+      route: leaf.node.route!,
+      rawParams,
+    }
+  } catch (err) {
+    if (err instanceof URIError) return null
+    throw err
   }
 }
 
@@ -829,10 +828,10 @@ function extractParams<T extends RouteLike>(
           nodePart.length - sufLength - 1,
         )
         const value = part!.substring(preLength, part!.length - sufLength)
-        rawParams[name] = decodeURIComponent(value)
+        rawParams[name] = decodeParam(value)
       } else {
         const name = nodePart.substring(1)
-        rawParams[name] = decodeURIComponent(part!)
+        rawParams[name] = decodeParam(part!)
       }
     } else if (node.kind === SEGMENT_TYPE_OPTIONAL_PARAM) {
       if (leaf.skipped & (1 << nodeIndex)) {
@@ -852,14 +851,14 @@ function extractParams<T extends RouteLike>(
         node.suffix || node.prefix
           ? part!.substring(preLength, part!.length - sufLength)
           : part
-      if (value) rawParams[name] = decodeURIComponent(value)
+      if (value) rawParams[name] = decodeParam(value)
     } else if (node.kind === SEGMENT_TYPE_WILDCARD) {
       const n = node
       const value = path.substring(
         currentPathIndex + (n.prefix?.length ?? 0),
         path.length - (n.suffix?.length ?? 0),
       )
-      const splat = decodeURIComponent(value)
+      const splat = decodeParam(value)
       // TODO: Deprecate *
       rawParams['*'] = splat
       rawParams._splat = splat
@@ -1210,7 +1209,7 @@ function getNodeMatch<T extends RouteLike>(
     }
     const splat = sliceIndex === path.length ? '/' : path.slice(sliceIndex)
     bestFuzzy.rawParams ??= Object.create(null)
-    bestFuzzy.rawParams!['**'] = decodeURIComponent(splat)
+    bestFuzzy.rawParams!['**'] = decodeParam(splat)
     return bestFuzzy
   }
 
diff --git a/packages/router-core/src/path.ts b/packages/router-core/src/path.ts
index 26b55b4b419..c7be5830683 100644
--- a/packages/router-core/src/path.ts
+++ b/packages/router-core/src/path.ts
@@ -1,5 +1,10 @@
 import { isServer } from '@tanstack/router-core/isServer'
 import { last } from './utils'
+import {
+  encodePathParam,
+  type EncodedPath,
+  type EncodedPathParam,
+} from './string-encoding'
 import {
   SEGMENT_TYPE_OPTIONAL_PARAM,
   SEGMENT_TYPE_PARAM,
@@ -190,33 +195,14 @@ export function resolvePath({
   return result
 }
 
-/**
- * Create a pre-compiled decode config from allowed characters.
- * This should be called once at router initialization.
- */
-export function compileDecodeCharMap(
-  pathParamsAllowedCharacters: ReadonlyArray<string>,
-) {
-  const charMap = new Map(
-    pathParamsAllowedCharacters.map((char) => [encodeURIComponent(char), char]),
-  )
-  // Escape special regex characters and join with |
-  const pattern = Array.from(charMap.keys())
-    .map((key) => key.replace(/[.*+?^${}()|[\]\\]/g, '\\$&'))
-    .join('|')
-  const regex = new RegExp(pattern, 'g')
-  return (encoded: string) =>
-    encoded.replace(regex, (match) => charMap.get(match) ?? match)
-}
-
 interface InterpolatePathOptions {
   path?: string
   params: Record<string, unknown>
   /**
-   * A function that decodes a path parameter value.
+   * A function that un-escapes characters allowed in path params.
    * Obtained from `compileDecodeCharMap(pathParamsAllowedCharacters)`.
    */
-  decoder?: (encoded: string) => string
+  decoder?: (encoded: EncodedPathParam) => string
   /**
    * @internal
    * For testing only, in development mode we use the router.isServer value
@@ -225,7 +211,8 @@ interface InterpolatePathOptions {
 }
 
 type InterPolatePathResult = {
-  interpolatedPath: string
+  /** The fully interpolated path with all param values percent-encoded. */
+  interpolatedPath: EncodedPath
   usedParams: Record<string, unknown>
   isMissingParams: boolean // true if any params were not available when being looked up in the params object
 }
@@ -274,9 +261,13 @@ export function interpolatePath({
   const usedParams: Record<string, unknown> = Object.create(null)
 
   if (!path || path === '/')
-    return { interpolatedPath: '/', usedParams, isMissingParams }
+    return { interpolatedPath: '/' as EncodedPath, usedParams, isMissingParams }
   if (!path.includes('$'))
-    return { interpolatedPath: path, usedParams, isMissingParams }
+    return {
+      interpolatedPath: path as EncodedPath,
+      usedParams,
+      isMissingParams,
+    }
 
   if (isServer ?? rest.server) {
     // Fast path for common templates like `/posts/$id` or `/files/$`.
@@ -332,7 +323,7 @@ export function interpolatePath({
 
       if (path.endsWith('/')) joined += '/'
 
-      const interpolatedPath = joined || '/'
+      const interpolatedPath = (joined || '/') as EncodedPath
       return { usedParams, interpolatedPath, isMissingParams }
     }
   }
@@ -414,15 +405,7 @@ export function interpolatePath({
 
   if (path.endsWith('/')) joined += '/'
 
-  const interpolatedPath = joined || '/'
+  const interpolatedPath = (joined || '/') as EncodedPath
 
   return { usedParams, interpolatedPath, isMissingParams }
 }
-
-function encodePathParam(
-  value: string,
-  decoder?: InterpolatePathOptions['decoder'],
-) {
-  const encoded = encodeURIComponent(value)
-  return decoder?.(encoded) ?? encoded
-}
diff --git a/packages/router-core/src/router.ts b/packages/router-core/src/router.ts
index 900609098e6..fc2bfb6bc22 100644
--- a/packages/router-core/src/router.ts
+++ b/packages/router-core/src/router.ts
@@ -2,9 +2,7 @@ import { createBrowserHistory, parseHref } from '@tanstack/history'
 import { isServer, loadServerRoute } from '@tanstack/router-core/isServer'
 import {
   DEFAULT_PROTOCOL_ALLOWLIST,
-  decodePath,
   deepEqual,
-  encodePathLikeUrl,
   findLast,
   functionalUpdate,
   hasKeys,
@@ -13,6 +11,13 @@ import {
   nullReplaceEqualDeep,
   replaceEqualDeep,
 } from './utils'
+import { interpolatePath, resolvePath, trimPath, trimPathRight } from './path'
+import type { EncodedPathParam } from './string-encoding'
+import {
+  compileDecodeCharMap,
+  decodePath,
+  encodePathLikeUrl,
+} from './string-encoding'
 import {
   buildRouteBranch,
   findFlatMatch,
@@ -21,13 +26,6 @@ import {
   processRouteMasks,
   processRouteTree,
 } from './new-process-route-tree'
-import {
-  compileDecodeCharMap,
-  interpolatePath,
-  resolvePath,
-  trimPath,
-  trimPathRight,
-} from './path'
 import { createLRUCache } from './lru-cache'
 import { isNotFound } from './not-found'
 import { setupScrollRestoration } from './scroll-restoration'
@@ -1112,7 +1110,7 @@ export class RouterCore<
     LightweightRouteMatchCacheEntry
   >()
   isServer!: boolean
-  pathParamsDecoder?: (encoded: string) => string
+  pathParamsDecoder?: (encoded: EncodedPathParam) => string
   protocolAllowlist!: Set<string>
 
   /**
diff --git a/packages/router-core/src/scroll-restoration-script/server.ts b/packages/router-core/src/scroll-restoration-script/server.ts
index 5c5ce5e7348..cef0d272a97 100644
--- a/packages/router-core/src/scroll-restoration-script/server.ts
+++ b/packages/router-core/src/scroll-restoration-script/server.ts
@@ -3,7 +3,7 @@ import {
   defaultGetScrollRestorationKey,
   storageKey,
 } from '../scroll-restoration'
-import { escapeHtml } from '../utils'
+import { escapeHtml } from '../string-encoding'
 import type { AnyRouter } from '../router'
 
 const defaultInlineScrollRestorationScript = `(${minifiedScrollRestorationScript})(${escapeHtml(
diff --git a/packages/router-core/src/ssr/ssr-server.ts b/packages/router-core/src/ssr/ssr-server.ts
index 30d3bc48906..8cba3ea5234 100644
--- a/packages/router-core/src/ssr/ssr-server.ts
+++ b/packages/router-core/src/ssr/ssr-server.ts
@@ -5,7 +5,7 @@ import {
   createInlineCssStyleAsset,
   getStylesheetHref,
 } from '../manifest'
-import { decodePath } from '../utils'
+import { decodePath } from '../string-encoding'
 import { createLRUCache } from '../lru-cache'
 import { rootRouteId } from '../root'
 import { _getRenderedMatches } from '../load-client'
diff --git a/packages/router-core/src/string-encoding.ts b/packages/router-core/src/string-encoding.ts
new file mode 100644
index 00000000000..a51bf521cb4
--- /dev/null
+++ b/packages/router-core/src/string-encoding.ts
@@ -0,0 +1,183 @@
+/**
+ * Central module for URL-path string encoding and decoding. It is the only
+ * place in `src/` allowed to use `encodeURIComponent`/`decodeURI*` directly
+ * (enforced by ESLint) — see ./docs/string-handling.md for the full
+ * trust-boundary documentation.
+ *
+ * Malformed percent-encoding policy: param decoding throws `URIError`
+ * (`decodeParam`) and `findMatch` converts that into "no match".
+ */
+declare const encodedPathParamBrand: unique symbol
+export type EncodedPathParam = string & {
+  readonly [encodedPathParamBrand]: true
+}
+
+declare const decodedPathParamBrand: unique symbol
+export type DecodedPathParam = string & {
+  readonly [decodedPathParamBrand]: true
+}
+
+/** A full URL path whose parameters have been encoded (interpolatePath output). */
+declare const encodedPathBrand: unique symbol
+export type EncodedPath = string & { readonly [encodedPathBrand]: true }
+
+/** A full URL path that has been decoded (decodePath output; location.pathname). */
+declare const decodedPathBrand: unique symbol
+export type DecodedPath = string & { readonly [decodedPathBrand]: true }
+
+/**
+ * Decode a path-parameter value extracted from a URL pathname.
+ * Throws `URIError` on malformed percent-encoding (`%zz`, truncated `%E4%BD`);
+ * `findMatch` is the single choke point that turns that into "no match".
+ */
+export function decodeParam(value: string): DecodedPathParam {
+  return decodeURIComponent(value) as DecodedPathParam
+}
+
+// Must stay percent-encoded: control chars + WHATWG path-encode set subset
+// (", <, >, `, {, }). Space excluded on purpose — see docs/string-handling.md.
+// eslint-disable-next-line no-control-regex
+const PATH_UNSAFE_RE = /[\x00-\x1f\x7f"<>`{}]/g
+
+function sanitizePathSegment(segment: string): string {
+  return segment.replace(
+    PATH_UNSAFE_RE,
+    (ch) => '%' + ch.charCodeAt(0).toString(16).toUpperCase().padStart(2, '0'),
+  )
+}
+
+function decodeSegment(segment: string): string {
+  let decoded: string
+  try {
+    decoded = decodeURI(segment)
+  } catch {
+    // if the decoding fails, try to decode the various parts leaving the malformed tags in place
+    decoded = segment.replaceAll(/%[0-9A-F]{2}/gi, (match) => {
+      try {
+        return decodeURI(match)
+      } catch {
+        return match
+      }
+    })
+  }
+  return sanitizePathSegment(decoded)
+}
+
+export function decodePath(path: string): {
+  path: DecodedPath
+  handledProtocolRelativeURL: boolean
+} {
+  if (!path)
+    return { path: path as DecodedPath, handledProtocolRelativeURL: false }
+
+  // Fast path: most paths are already decoded and safe.
+  // Only fall back to the slower scan/regex path when we see a '%' (encoded),
+  // a backslash (explicitly handled), a control character, or a protocol-relative
+  // prefix which needs collapsing.
+  // eslint-disable-next-line no-control-regex
+  if (!/[%\\\x00-\x1f\x7f]/.test(path) && !path.startsWith('//')) {
+    return { path: path as DecodedPath, handledProtocolRelativeURL: false }
+  }
+
+  const re = /%25|%5C/gi
+  let cursor = 0
+  let result = ''
+  let match
+  while (null !== (match = re.exec(path))) {
+    result += decodeSegment(path.slice(cursor, match.index)) + match[0]
+    cursor = re.lastIndex
+  }
+  result = result + decodeSegment(cursor ? path.slice(cursor) : path)
+
+  // Prevent open redirect via protocol-relative URLs (e.g. "//evil.com")
+  // This is defense-in-depth: since control characters are no longer decoded,
+  // paths like "/%0d/evil.com" can no longer become "//evil.com". But we keep
+  // this check to guard against other edge cases.
+  let handledProtocolRelativeURL = false
+  if (result.startsWith('//')) {
+    handledProtocolRelativeURL = true
+    result = '/' + result.replace(/^\/+/, '')
+  }
+
+  return { path: result as DecodedPath, handledProtocolRelativeURL }
+}
+
+/**
+ * Encodes whitespace and non-ASCII like `new URL()` would, without URL parsing;
+ * preserves existing `%XX` sequences and ASCII specials. Used for SSR hrefs.
+ * Output is not fully encoded (`#` passes through), hence no brand.
+ */
+export function encodePathLikeUrl(path: string): string {
+  // Encode whitespace and non-ASCII characters that browsers encode in URLs
+
+  // biome-ignore lint/suspicious/noControlCharactersInRegex: intentional ASCII range check
+  // eslint-disable-next-line no-control-regex
+  if (!/\s|[^\u0000-\u007F]/.test(path)) return path
+  // biome-ignore lint/suspicious/noControlCharactersInRegex: intentional ASCII range check
+  // eslint-disable-next-line no-control-regex
+  return path.replace(/\s|[^\u0000-\u007F]/gu, encodeURIComponent)
+}
+
+/** URL for the dev-only route-scoped CSS endpoint, used by HeadContent. */
+export function buildDevStylesUrl(
+  basepath: string,
+  routeIds: Array<string>,
+): string {
+  // Trim all leading and trailing slashes from basepath
+  const trimmedBasepath = basepath.replace(/^\/+|\/+$/g, '')
+  // Build normalized basepath: empty string for root, or '/path' for non-root
+  const normalizedBasepath = trimmedBasepath === '' ? '' : `/${trimmedBasepath}`
+  return `${normalizedBasepath}/@tanstack-start/styles.css?routes=${encodeURIComponent(routeIds.join(','))}`
+}
+
+// Based on https://github.com/zertosh/htmlescape (MIT)
+const HTML_ESCAPE_LOOKUP: { [match: string]: string } = {
+  '&': '\\u0026',
+  '>': '\\u003e',
+  '<': '\\u003c',
+  '\u2028': '\\u2028',
+  '\u2029': '\\u2029',
+}
+
+const HTML_ESCAPE_REGEX = /[&><\u2028\u2029]/g
+
+/**
+ * Escape HTML special characters to prevent XSS when embedding strings in
+ * inline `<script>` tags during SSR. Based on https://github.com/zertosh/htmlescape
+ */
+export function escapeHtml(str: string): string {
+  return str.replace(HTML_ESCAPE_REGEX, (match) => HTML_ESCAPE_LOOKUP[match]!)
+}
+
+/**
+ * Percent-encode a single path-parameter value so that `/ ? #` etc. in the
+ * value cannot change URL structure. The optional `decoder` (from
+ * `compileDecodeCharMap`) selectively un-escapes allowed characters.
+ */
+export function encodePathParam(
+  value: string,
+  decoder?: (encoded: EncodedPathParam) => string,
+): EncodedPathParam {
+  const encoded = encodeURIComponent(value)
+  return (decoder?.(encoded as EncodedPathParam) ?? encoded) as EncodedPathParam
+}
+
+/**
+ * Create a pre-compiled decoder that selectively un-escapes characters from
+ * `pathParamsAllowedCharacters`. This should be called once at router
+ * initialization and passed to `interpolatePath` as `decoder`.
+ */
+export function compileDecodeCharMap(
+  pathParamsAllowedCharacters: ReadonlyArray<string>,
+): (encoded: EncodedPathParam) => string {
+  const charMap = new Map(
+    pathParamsAllowedCharacters.map((char) => [encodeURIComponent(char), char]),
+  )
+  // Escape special regex characters and join with |
+  const pattern = Array.from(charMap.keys())
+    .map((key) => key.replace(/[.*+?^${}()|[\]\\]/g, '\\$&'))
+    .join('|')
+  const regex = new RegExp(pattern, 'g')
+  return (encoded) =>
+    encoded.replace(regex, (match) => charMap.get(match) ?? match)
+}
diff --git a/packages/router-core/src/utils.ts b/packages/router-core/src/utils.ts
index 997c661bb52..bf4eab02b2a 100644
--- a/packages/router-core/src/utils.ts
+++ b/packages/router-core/src/utils.ts
@@ -525,46 +525,6 @@ export function findLast<T>(
   return undefined
 }
 
-/**
- * Re-encode characters that are unsafe in URL paths.
- * Includes ASCII control characters (0x00-0x1F, 0x7F) and a subset of the
- * WHATWG URL "path percent-encode set" (", <, >, `, {, }).
- *
- * Space (0x20) is intentionally excluded — decodeURI decodes %20 to space
- * and the router stores decoded spaces in location.pathname. The existing
- * encodePathLikeUrl already handles re-encoding spaces for outgoing URLs.
- *
- * These characters are decoded by decodeURI but must remain percent-encoded
- * in paths to match how upstream layers (CDNs, edge middleware, browsers)
- * interpret the URL, preventing infinite redirect loops and path mismatches.
- */
-// eslint-disable-next-line no-control-regex
-const PATH_UNSAFE_RE = /[\x00-\x1f\x7f"<>`{}]/g
-
-function sanitizePathSegment(segment: string): string {
-  return segment.replace(
-    PATH_UNSAFE_RE,
-    (ch) => '%' + ch.charCodeAt(0).toString(16).toUpperCase().padStart(2, '0'),
-  )
-}
-
-function decodeSegment(segment: string): string {
-  let decoded: string
-  try {
-    decoded = decodeURI(segment)
-  } catch {
-    // if the decoding fails, try to decode the various parts leaving the malformed tags in place
-    decoded = segment.replaceAll(/%[0-9A-F]{2}/gi, (match) => {
-      try {
-        return decodeURI(match)
-      } catch {
-        return match
-      }
-    })
-  }
-  return sanitizePathSegment(decoded)
-}
-
 /**
  * Default list of URL protocols to allow in links, redirects, and navigation.
  * Any absolute URL protocol not in this list is treated as dangerous by default.
@@ -612,114 +572,6 @@ export function isDangerousProtocol(
   }
 }
 
-// This utility is based on https://github.com/zertosh/htmlescape
-// License: https://github.com/zertosh/htmlescape/blob/0527ca7156a524d256101bb310a9f970f63078ad/LICENSE
-const HTML_ESCAPE_LOOKUP: { [match: string]: string } = {
-  '&': '\\u0026',
-  '>': '\\u003e',
-  '<': '\\u003c',
-  '\u2028': '\\u2028',
-  '\u2029': '\\u2029',
-}
-
-const HTML_ESCAPE_REGEX = /[&><\u2028\u2029]/g
-
-/**
- * Escape HTML special characters in a string to prevent XSS attacks
- * when embedding strings in script tags during SSR.
- *
- * This is essential for preventing XSS vulnerabilities when user-controlled
- * content is embedded in inline scripts.
- */
-export function escapeHtml(str: string): string {
-  return str.replace(HTML_ESCAPE_REGEX, (match) => HTML_ESCAPE_LOOKUP[match]!)
-}
-
-export function decodePath(path: string) {
-  if (!path) return { path, handledProtocolRelativeURL: false }
-
-  // Fast path: most paths are already decoded and safe.
-  // Only fall back to the slower scan/regex path when we see a '%' (encoded),
-  // a backslash (explicitly handled), a control character, or a protocol-relative
-  // prefix which needs collapsing.
-  // eslint-disable-next-line no-control-regex
-  if (!/[%\\\x00-\x1f\x7f]/.test(path) && !path.startsWith('//')) {
-    return { path, handledProtocolRelativeURL: false }
-  }
-
-  const re = /%25|%5C/gi
-  let cursor = 0
-  let result = ''
-  let match
-  while (null !== (match = re.exec(path))) {
-    result += decodeSegment(path.slice(cursor, match.index)) + match[0]
-    cursor = re.lastIndex
-  }
-  result = result + decodeSegment(cursor ? path.slice(cursor) : path)
-
-  // Prevent open redirect via protocol-relative URLs (e.g. "//evil.com")
-  // This is defense-in-depth: since control characters are no longer decoded,
-  // paths like "/%0d/evil.com" can no longer become "//evil.com". But we keep
-  // this check to guard against other edge cases.
-  let handledProtocolRelativeURL = false
-  if (result.startsWith('//')) {
-    handledProtocolRelativeURL = true
-    result = '/' + result.replace(/^\/+/, '')
-  }
-
-  return { path: result, handledProtocolRelativeURL }
-}
-
-/**
- * Encodes a path the same way `new URL()` would, but without the overhead of full URL parsing.
- *
- * This function encodes:
- * - Whitespace characters (spaces → %20, tabs → %09, etc.)
- * - Non-ASCII/Unicode characters (emojis, accented characters, etc.)
- *
- * It preserves:
- * - Already percent-encoded sequences (won't double-encode %2F, %25, etc.)
- * - ASCII special characters valid in URL paths (@, $, &, +, etc.)
- * - Forward slashes as path separators
- *
- * Used to generate proper href values for SSR without constructing URL objects.
- *
- * @example
- * encodePathLikeUrl('/path/file name.pdf') // '/path/file%20name.pdf'
- * encodePathLikeUrl('/path/日本語') // '/path/%E6%97%A5%E6%9C%AC%E8%AA%9E'
- * encodePathLikeUrl('/path/already%20encoded') // '/path/already%20encoded' (preserved)
- */
-export function encodePathLikeUrl(path: string): string {
-  // Encode whitespace and non-ASCII characters that browsers encode in URLs
-
-  // biome-ignore lint/suspicious/noControlCharactersInRegex: intentional ASCII range check
-  // eslint-disable-next-line no-control-regex
-  if (!/\s|[^\u0000-\u007F]/.test(path)) return path
-  // biome-ignore lint/suspicious/noControlCharactersInRegex: intentional ASCII range check
-  // eslint-disable-next-line no-control-regex
-  return path.replace(/\s|[^\u0000-\u007F]/gu, encodeURIComponent)
-}
-
-/**
- * Builds the dev-mode CSS styles URL for route-scoped CSS collection.
- * Used by HeadContent components in all framework implementations to construct
- * the URL for the `/@tanstack-start/styles.css` endpoint.
- *
- * @param basepath - The router's basepath (may or may not have leading slash)
- * @param routeIds - Array of matched route IDs to include in the CSS collection
- * @returns The full URL path for the dev styles CSS endpoint
- */
-export function buildDevStylesUrl(
-  basepath: string,
-  routeIds: Array<string>,
-): string {
-  // Trim all leading and trailing slashes from basepath
-  const trimmedBasepath = basepath.replace(/^\/+|\/+$/g, '')
-  // Build normalized basepath: empty string for root, or '/path' for non-root
-  const normalizedBasepath = trimmedBasepath === '' ? '' : `/${trimmedBasepath}`
-  return `${normalizedBasepath}/@tanstack-start/styles.css?routes=${encodeURIComponent(routeIds.join(','))}`
-}
-
 export function arraysEqual<T>(a: Array<T>, b: Array<T>) {
   if (a === b) return true
   if (a.length !== b.length) return false
diff --git a/packages/router-core/tests/malformed-percent.test.ts b/packages/router-core/tests/malformed-percent.test.ts
new file mode 100644
index 00000000000..41bbc6f358c
--- /dev/null
+++ b/packages/router-core/tests/malformed-percent.test.ts
@@ -0,0 +1,136 @@
+import { describe, expect, it } from 'vitest'
+import {
+  findFlatMatch,
+  findRouteMatch,
+  findSingleMatch,
+  processRouteMasks,
+  processRouteTree,
+} from '../src/new-process-route-tree'
+import { decodePath } from '../src/string-encoding'
+import { interpolatePath } from '../src/path'
+import type { RouteMask } from '../src'
+
+function makeTree(routes: Array<string>) {
+  return processRouteTree({
+    id: '__root__',
+    isRoot: true,
+    fullPath: '/',
+    path: '/',
+    children: routes.map((route) => ({
+      id: route,
+      fullPath: `/${route}`,
+      path: route,
+    })),
+  })
+}
+
+function makeMaskedTree(from: string) {
+  const routeTree = {
+    id: '__root__',
+    isRoot: true,
+    fullPath: '/',
+  } as any
+  const processedTree = makeTree(['$id']).processedTree
+  const routeMasks = [
+    { from, to: '/$id' },
+    { from, routeTree },
+  ] as Array<RouteMask<any>>
+  processRouteMasks(routeMasks, processedTree)
+  return processedTree
+}
+
+describe('malformed percent-encoding in paths', () => {
+  // These inputs previously caused `URIError` to escape `extractParams` via
+  // `findFlatMatch` (route masks) and `findSingleMatch` (`router.matchRoute`),
+  // which had no guard. `findRouteMatch` caught them and returned null (404);
+  // that is now the uniform behavior for every entry point.
+  const malformedPaths = [
+    '/post/%E4%BD', // truncated multi-byte sequence
+    '/post/%zz', // non-hex sequence
+    '/post/%', // bare percent
+    '/%ED%A0%80', // UTF-8 encoded surrogate
+  ]
+
+  it.each(malformedPaths)('findRouteMatch does not throw for %s', (path) => {
+    const { processedTree } = makeTree(['$id', 'files/*'])
+    expect(() => findRouteMatch(path, processedTree)).not.toThrow()
+  })
+
+  it.each(malformedPaths)('findRouteMatch treats %s as no match', (path) => {
+    const { processedTree } = makeTree(['$id'])
+    expect(findRouteMatch(path, processedTree)).toBeNull()
+  })
+
+  it.each(malformedPaths)(
+    'findFlatMatch does not throw for %s (route masks)',
+    (path) => {
+      const processedTree = makeMaskedTree('/to/$id')
+      // note: `decodePath` leaves malformed sequences intact, so this is what
+      // mask matching would see in production for such a URL
+      expect(() =>
+        findFlatMatch(path.replace('/post/', '/to/'), processedTree),
+      ).not.toThrow()
+    },
+  )
+
+  it.each(malformedPaths)(
+    'findSingleMatch does not throw for %s (matchRoute)',
+    (path) => {
+      const single = processRouteTree({ id: 'single', from: '/$id' } as any)
+      expect(() =>
+        findSingleMatch('/$id', false, false, path, single.processedTree),
+      ).not.toThrow()
+    },
+  )
+
+  it('wildcard routes treat malformed splats as no match instead of crashing', () => {
+    const { processedTree } = makeTree(['files/*'])
+    expect(findRouteMatch('/files/%E4%BD', processedTree)).toBeNull()
+  })
+
+  it('still decodes valid sequences after decodePath, like production matching', () => {
+    const { processedTree } = makeTree(['$id'])
+    const decoded = decodePath('/caf%C3%A9').path
+    const match = findRouteMatch(decoded, processedTree)
+    expect(match?.rawParams).toEqual({ id: 'café' })
+  })
+
+  it('double-encoded percents still decode one level in params', () => {
+    const { processedTree } = makeTree(['$id'])
+    // decodePath preserves %25; the matcher decodes it to '%'
+    const match = findRouteMatch('/100%25', processedTree)
+    expect(match?.rawParams).toEqual({ id: '100%' })
+  })
+
+  it('mixed valid and malformed sequences are no match', () => {
+    const { processedTree } = makeTree(['$id'])
+    expect(findRouteMatch('/a%20b%E4%BD', processedTree)).toBeNull()
+  })
+
+  it('fuzzy matching treats malformed splats as no match instead of crashing', () => {
+    const { processedTree } = makeTree(['parent'])
+    expect(() =>
+      findRouteMatch('/parent/child/%E4%BD', processedTree, true),
+    ).not.toThrow()
+    expect(
+      findRouteMatch('/parent/child/%E4%BD', processedTree, true),
+    ).toBeNull()
+  })
+})
+
+describe('known quirk: `*` splat value collides with legacy wildcard syntax', () => {
+  it('a splat param of `*` produces a URL that resolves to the legacy wildcard route with no params', () => {
+    // This documents current behavior. If this ever gets fixed (e.g. by
+    // encoding `*` as `%2A` in splat interpolation), update the property
+    // test in string-encoding.property.test.ts accordingly.
+    const { interpolatedPath } = interpolatePath({
+      path: '/files/$',
+      params: { _splat: '*' },
+    })
+    expect(interpolatedPath).toBe('/files/*')
+    const { processedTree } = makeTree(['files/$', 'files/*'])
+    const match = findRouteMatch('/files/*', processedTree)
+    expect(match?.route.id).toBe('files/*')
+    expect(match?.rawParams).toEqual({})
+  })
+})
diff --git a/packages/router-core/tests/path.test.ts b/packages/router-core/tests/path.test.ts
index 49c8f022e72..6ba9be9b1a4 100644
--- a/packages/router-core/tests/path.test.ts
+++ b/packages/router-core/tests/path.test.ts
@@ -1,12 +1,12 @@
 import { describe, expect, it } from 'vitest'
 import {
-  compileDecodeCharMap,
   exactPathTest,
   interpolatePath,
   removeTrailingSlash,
   resolvePath,
   trimPathLeft,
 } from '../src/path'
+import { compileDecodeCharMap } from '../src/string-encoding'
 import {
   SEGMENT_TYPE_PARAM,
   SEGMENT_TYPE_PATHNAME,
diff --git a/packages/router-core/tests/search-params.property.test.ts b/packages/router-core/tests/search-params.property.test.ts
new file mode 100644
index 00000000000..a4119e5ab58
--- /dev/null
+++ b/packages/router-core/tests/search-params.property.test.ts
@@ -0,0 +1,86 @@
+import fc from 'fast-check'
+import { describe, expect, it } from 'vitest'
+import { defaultParseSearch, defaultStringifySearch } from '../src/searchParams'
+
+/**
+ * Property-based invariants for the default search-param serializers.
+ *
+ * The query string is attacker-controlled: JSON.parse runs on URL text and
+ * parsed values flow into loaders/search validation. These properties pin
+ * the guarantees (and the deliberate, documented quirks) of the pipeline.
+ */
+
+// JSON-safe values with string keys; keys become strings through any object
+const jsonValueArb: fc.Arbitrary<unknown> = fc.oneof(
+  fc.string(),
+  fc.integer(),
+  fc.boolean(),
+  fc.constant(null),
+  fc.array(fc.integer(), { maxLength: 3 }),
+  fc.record({ a: fc.integer(), b: fc.boolean() }, { maxKeys: 2 }),
+)
+
+describe('default search param serialization', () => {
+  it('parsing never throws for any search string', () => {
+    fc.assert(
+      fc.property(fc.string(), (search) => {
+        expect(() => defaultParseSearch(search)).not.toThrow()
+      }),
+    )
+  })
+
+  it('parse result always has a null prototype', () => {
+    ;(fc.assert(
+      fc.property(fc.string(), (search) => {
+        const result = defaultParseSearch(search)
+        expect(Object.getPrototypeOf(result)).toBe(null)
+      }),
+    ),
+      { numRuns: 200 })
+  })
+
+  it('round-trips JSON values: stringify then parse yields equal data', () => {
+    fc.assert(
+      fc.property(
+        fc.dictionary(fc.string({ maxLength: 8 }), jsonValueArb, {
+          maxKeys: 5,
+        }),
+        (searchObj) => {
+          const serialized = defaultStringifySearch(searchObj)
+          const parsed = defaultParseSearch(serialized)
+          expect(parsed).toEqual(searchObj)
+        },
+      ),
+    )
+  })
+
+  it('__proto__ as key never pollutes Object.prototype', () => {
+    const result = defaultParseSearch(
+      '?__proto__=%7B%22polluted%22%3Atrue%7D&safe=1',
+    )
+    expect((Object.prototype as any).polluted).toBeUndefined()
+    expect(({} as any).polluted).toBeUndefined()
+    // readable as own property data
+    expect(Object.getOwnPropertyDescriptor(result, '__proto__')).toBeDefined()
+  })
+
+  it('malformed JSON values stay strings instead of throwing', () => {
+    // '{' can start JSON so the parser is attempted; failure must be silent
+    const result = defaultParseSearch('?q=%7Binvalid%20json%7D')
+    expect(result.q).toBe('{invalid json}')
+  })
+
+  it('DOCUMENTED QUIRK: strings that look like JSON are type-coerced on read', () => {
+    // ' 42' / 'true' / '[1]' parse as JSON after leading-whitespace trim,
+    // so a plain string value changes type across a read. This is long-
+    // standing designed behavior (JSON-ish coercion), pinned here so a
+    // change is conscious. Apps needing exact strings must use custom
+    // search param serialization or stringifiable wrappers.
+    expect(defaultParseSearch('?q=%2042').q).toBe(42)
+    expect(defaultParseSearch('?q=true').q).toBe(true)
+    expect(defaultParseSearch('?q=%5B1%2C2%5D').q).toEqual([1, 2])
+    // but non-JSON-looking strings are untouched
+    expect(defaultParseSearch('?q=navy').q).toBe('navy')
+    expect(defaultParseSearch('?q=01').q).toBe('01')
+  })
+})
diff --git a/packages/router-core/tests/ssr-injection.test.ts b/packages/router-core/tests/ssr-injection.test.ts
new file mode 100644
index 00000000000..23572acf293
--- /dev/null
+++ b/packages/router-core/tests/ssr-injection.test.ts
@@ -0,0 +1,128 @@
+import { readFileSync } from 'node:fs'
+import { dirname, join } from 'node:path'
+import { fileURLToPath } from 'node:url'
+import { createMemoryHistory } from '@tanstack/history'
+import { afterEach, describe, expect, test, vi } from 'vitest'
+import { getScrollRestorationScriptForRouter } from '../src/scroll-restoration-script/server'
+import { BaseRootRoute, BaseRoute, storageKey } from '../src'
+import { createTestRouter } from './routerTestUtils'
+
+/**
+ * The scroll restoration script interpolates a user-supplied `getKey` value
+ * into an inline <script> during SSR. escapeHtml(JSON.stringify(key)) is the
+ * XSS mitigation; these tests verify it holds for adversarial inputs AND
+ * that escaping stays semantically transparent (the script must restore the
+ * exact original key, not just "look safe").
+ */
+
+function createScrollRestorationRouter(getScrollRestorationKey: () => string) {
+  const rootRoute = new BaseRootRoute({})
+  const indexRoute = new BaseRoute({
+    getParentRoute: () => rootRoute,
+    path: '/',
+  })
+
+  return createTestRouter({
+    routeTree: rootRoute.addChildren([indexRoute]),
+    history: createMemoryHistory({ initialEntries: ['/'] }),
+    isServer: true,
+    scrollRestoration: true,
+    getScrollRestorationKey,
+  })
+}
+
+afterEach(() => {
+  window.sessionStorage.clear()
+  vi.unstubAllGlobals()
+})
+
+describe('scroll restoration script XSS resistance', () => {
+  const maliciousKeys = [
+    '</script><script>alert(1)</script>',
+    '"}; alert(1); {"',
+    "'+alert(1)+'",
+    "\\'; alert(1); \\'",
+    'key\u2028with\u2029separators',
+    '${alert(1)}',
+    '<img src=x onerror=alert(1)>',
+  ]
+
+  test.each(maliciousKeys)(
+    'script for key %j contains no context-breaking sequences',
+    (key) => {
+      const router = createScrollRestorationRouter(() => key)
+      const script = getScrollRestorationScriptForRouter(router)!
+      // nothing may close/reopen the surrounding <script> tag
+      expect(script.toLowerCase()).not.toContain('</script')
+      expect(script.toLowerCase()).not.toContain('<script')
+      // U+2028/U+2029 are line terminators inside JS strings; must be escaped
+      expect(script).not.toMatch(/[\u2028\u2029]/)
+      // eslint-disable-next-line no-control-regex
+      expect(script).not.toMatch(/[\x00-\x1f\x7f]/)
+    },
+  )
+
+  test.each(maliciousKeys)(
+    'script for key %j restores scroll state stored under the exact key',
+    (key) => {
+      const router = createScrollRestorationRouter(() => key)
+      const script = getScrollRestorationScriptForRouter(router)!
+
+      window.sessionStorage.setItem(
+        storageKey,
+        JSON.stringify({ [key]: { window: { scrollX: 11, scrollY: 22 } } }),
+      )
+      const scrollTo = vi.fn()
+      vi.stubGlobal('scrollTo', scrollTo)
+
+      expect(() => new Function(script)()).not.toThrow()
+      // proves the escaped key round-tripped to exactly the original value:
+      // the inline script found our entry and scrolled
+      expect(scrollTo).toHaveBeenCalledWith(11, 22)
+    },
+  )
+
+  test('injected code inside a key is never executed', () => {
+    // if escaping were broken, this key would terminate the string literal
+    // and execute alert() during script evaluation
+    let executed = false
+    const router = createScrollRestorationRouter(() => '"}; alert(1); {"')
+    const script = getScrollRestorationScriptForRouter(router)!
+    vi.stubGlobal('alert', () => {
+      executed = true
+    })
+    new Function(script)()
+    expect(executed).toBe(false)
+  })
+})
+
+describe('seroval stream factory canary', () => {
+  // FACTORY_BINARY / FACTORY_TEXT are static minified JS shipped into inline
+  // scripts and evaluated client-side. They must never gain interpolation
+  // points - any future `${...}` or concatenation with non-literal data would
+  // become an eval-injection sink.
+  const src = readFileSync(
+    join(
+      dirname(fileURLToPath(import.meta.url)),
+      '../src/ssr/serializer/RawStream.ts',
+    ),
+    'utf8',
+  )
+
+  function extractFactory(name: string): string {
+    const match = src.match(new RegExp(`${name}\\s*=\\s*([\\s\\S]*?)\\n`))
+    expect(match, `${name} not found in RawStream.ts`).not.toBeNull()
+    return match![1]!
+  }
+
+  test.each(['FACTORY_BINARY', 'FACTORY_TEXT'])(
+    '%s contains no interpolation points',
+    (name) => {
+      const literal = extractFactory(name)
+      expect(literal.startsWith('`')).toBe(true)
+      expect(literal).not.toContain('${')
+      expect(literal).not.toContain("' +")
+      expect(literal).not.toContain('+ `')
+    },
+  )
+})
diff --git a/packages/router-core/tests/string-encoding.bench.ts b/packages/router-core/tests/string-encoding.bench.ts
new file mode 100644
index 00000000000..0f9b58d5419
--- /dev/null
+++ b/packages/router-core/tests/string-encoding.bench.ts
@@ -0,0 +1,84 @@
+import { bench, describe } from 'vitest'
+import { decodePath } from '../src/string-encoding'
+import { findRouteMatch, processRouteTree } from '../src/new-process-route-tree'
+import { interpolatePath } from '../src/path'
+
+/**
+ * Benchmarks for the hot string encoding/decoding paths.
+ *
+ * These run on every navigation, so regressions here are user-visible.
+ * Used to validate that hardening changes (e.g. safeDecodeURIComponent)
+ * do not degrade performance. Run with: pnpm vitest bench tests/string-encoding.bench.ts
+ */
+
+const tree = processRouteTree({
+  id: '__root__',
+  isRoot: true,
+  fullPath: '/',
+  path: '/',
+  children: [
+    { id: '/$', fullPath: '/$', path: '$' },
+    { id: '/posts', fullPath: '/posts', path: 'posts' },
+    { id: '/posts/$id', fullPath: '/posts/$id', path: 'posts/$id' },
+    { id: '/files/$', fullPath: '/files/$', path: 'files/$' },
+    {
+      id: '/users/$userId/settings',
+      fullPath: '/users/$userId/settings',
+      path: 'users/$userId/settings',
+    },
+  ],
+}).processedTree
+
+const plainPath = '/posts/123/settings'
+const unicodePath = '/café/日本語/🎉'
+const encodedPath = '/a%20b%2Fc%3Fd%23e'
+const params = {
+  id: 'hello world/with specials?&#',
+  _splat: 'docs/v1/getting started.md',
+}
+
+describe('decodePath', () => {
+  bench('plain ascii path (fast path)', () => {
+    decodePath(plainPath)
+  })
+
+  bench('unicode path', () => {
+    decodePath(unicodePath)
+  })
+
+  bench('heavily encoded path', () => {
+    decodePath(encodedPath)
+  })
+})
+
+describe('interpolatePath', () => {
+  bench('single param', () => {
+    interpolatePath({ path: '/posts/$id', params })
+  })
+
+  bench('multiple params + splat', () => {
+    interpolatePath({ path: '/users/$userId/files/$', params })
+  })
+})
+
+describe('findRouteMatch', () => {
+  bench('static match', () => {
+    findRouteMatch('/posts', tree)
+  })
+
+  bench('param match', () => {
+    findRouteMatch('/posts/123', tree)
+  })
+
+  bench('deep param match', () => {
+    findRouteMatch('/users/42/settings', tree)
+  })
+
+  bench('splat match', () => {
+    findRouteMatch('/files/docs/v1/readme.md', tree)
+  })
+
+  bench('encoded param match', () => {
+    findRouteMatch('/posts/hello%20world', tree)
+  })
+})
diff --git a/packages/router-core/tests/string-encoding.property.test.ts b/packages/router-core/tests/string-encoding.property.test.ts
new file mode 100644
index 00000000000..6ad59d60763
--- /dev/null
+++ b/packages/router-core/tests/string-encoding.property.test.ts
@@ -0,0 +1,250 @@
+import fc from 'fast-check'
+import { describe, expect, it } from 'vitest'
+import { decodePath, encodePathParam, escapeHtml } from '../src/string-encoding'
+import { findRouteMatch, processRouteTree } from '../src/new-process-route-tree'
+import { interpolatePath } from '../src/path'
+import { decode as decodeQueryString } from '../src/qss'
+
+/**
+ * Property-based invariants for the string encoding boundary.
+ *
+ * Each property here encodes a guarantee documented in
+ * src/string-encoding.ts. If one of these fails, the guarantee is broken —
+ * fix the implementation or consciously change the documented contract.
+ */
+
+/** Strings with percent-encoding fragments and control characters injected. */
+const mangledStringArb = fc
+  .array(
+    fc.oneof(
+      fc.string(),
+      fc.constantFrom('%', '%25', '%zz', '%E4%BD', '%2F', '%00', '%0d', '%0a'),
+      fc.constantFrom('\r', '\n', '\x00', '\x7f', '<', '>', '"', '`', '{', '}'),
+      fc.constantFrom('//', '/evil.com'),
+    ),
+    { maxLength: 12 },
+  )
+  .map((parts) => parts.join(''))
+
+/** True if the string contains lone (unpaired) UTF-16 surrogates. */
+function hasLoneSurrogates(s: string): boolean {
+  const withoutPairs = s.replace(/[\uD800-\uDBFF][\uDC00-\uDFFF]/g, '')
+  return /[\uD800-\uDFFF]/.test(withoutPairs)
+}
+
+// Values containing lone surrogates are excluded: encodeURIComponent itself
+// does not round-trip those (it produces %ED%A0%80-style sequences that its
+// own decoder rejects), and the router treats them as malformed — no match.
+const roundTripValueArb = fc.string().filter((s) => !hasLoneSurrogates(s))
+
+/** Native decode, or null when the input is malformed (incl. lone surrogates). */
+function nativeDecode(s: string): string | null {
+  try {
+    return decodeURIComponent(s)
+  } catch {
+    return null
+  }
+}
+
+describe('encodePathParam properties', () => {
+  it('round-trips through decodeURIComponent for any value', () => {
+    fc.assert(
+      fc.property(roundTripValueArb, (value) => {
+        expect(decodeURIComponent(encodePathParam(value))).toBe(value)
+      }),
+    )
+  })
+
+  it('output never contains raw separators (?, #) or control characters', () => {
+    fc.assert(
+      fc.property(roundTripValueArb, (value) => {
+        const encoded = encodePathParam(value)
+        // eslint-disable-next-line no-control-regex
+        expect(encoded).not.toMatch(/[?#\r\n\0]/)
+      }),
+    )
+  })
+})
+
+describe('matcher integration properties', () => {
+  const tree = processRouteTree({
+    id: '__root__',
+    isRoot: true,
+    fullPath: '/',
+    path: '/',
+    children: [
+      { id: '/$id', fullPath: '/$id', path: '$id' },
+      { id: '/files/$', fullPath: '/files/$', path: 'files/$' },
+      { id: '/files/*', fullPath: '/files/*', path: 'files/*' },
+    ],
+  }).processedTree
+
+  it('matching is total: never throws for any path', () => {
+    fc.assert(
+      fc.property(mangledStringArb, (path) => {
+        const prefixed = `/${path.replace(/^\//, '')}`
+        expect(() => findRouteMatch(prefixed, tree)).not.toThrow()
+        expect(() => findRouteMatch(prefixed, tree, true)).not.toThrow()
+      }),
+    )
+  })
+
+  it('recovers a param value exactly after encode → decodePath → match', () => {
+    fc.assert(
+      fc.property(
+        roundTripValueArb.filter((v) => v !== '' && !v.includes('/')),
+        (value) => {
+          const { interpolatedPath } = interpolatePath({
+            path: '/$id',
+            params: { id: value },
+          })
+          const decoded = decodePath(interpolatedPath).path
+          const match = findRouteMatch(decoded, tree)
+          // whenever the value survives a native encode/decode cycle the router
+          // must recover it exactly; otherwise it must be treated as no-match
+          if (nativeDecode(encodeURIComponent(value)) === value) {
+            expect(match?.rawParams?.id).toBe(value)
+          } else {
+            expect(match).toBeNull()
+          }
+        },
+      ),
+    )
+  })
+
+  // KNOWN PRE-EXISTING QUIRK (documented, not fixed here): a splat value of
+  // `*` interpolates to `/files/*`, which collides with the legacy `*`
+  // wildcard syntax and therefore does not round-trip. Values containing `*`
+  // are excluded from the property below; if you fix the collision, remove
+  // the filter and this note.
+  it('splat params preserve slashes and round-trip', () => {
+    fc.assert(
+      fc.property(
+        roundTripValueArb.filter(
+          (v) =>
+            v !== '' &&
+            !v.startsWith('/') &&
+            !v.endsWith('/') &&
+            !v.includes('*'),
+        ),
+        (value) => {
+          const { interpolatedPath } = interpolatePath({
+            path: '/files/$',
+            params: { _splat: value },
+          })
+          const decoded = decodePath(interpolatedPath).path
+          const match = findRouteMatch(decoded, tree)
+          if (nativeDecode(encodeURIComponent(value)) === value) {
+            expect(match?.rawParams?._splat).toBe(value)
+          } else {
+            expect(match).toBeNull()
+          }
+        },
+      ),
+    )
+  })
+})
+
+describe('decodePath properties', () => {
+  it('is total: never throws for any input', () => {
+    fc.assert(
+      fc.property(mangledStringArb, (path) => {
+        expect(() => decodePath(path)).not.toThrow()
+      }),
+    )
+  })
+
+  it('never returns a protocol-relative path (open-redirect defense)', () => {
+    fc.assert(
+      fc.property(mangledStringArb, (path) => {
+        const { path: result } = decodePath(path)
+        expect(result.startsWith('//')).toBe(false)
+      }),
+    )
+  })
+
+  it('never introduces unsafe characters that were not already literal in the input', () => {
+    // Characters like `"`, `<`, `>`, control chars must stay percent-encoded
+    // after a decode round. Literal occurrences in the input pass through
+    // untouched (browsers percent-encode them anyway before they reach the
+    // router); decoding must never *create* new ones.
+    fc.assert(
+      fc.property(mangledStringArb, (path) => {
+        const { path: result } = decodePath(path)
+        const unsafeRe = /[\x00-\x1f\x7f"<>`{}]/g
+        const inputUnsafe = new Set(path.match(unsafeRe) ?? [])
+        for (const ch of result.match(unsafeRe) ?? []) {
+          expect(inputUnsafe.has(ch)).toBe(true)
+        }
+      }),
+    )
+  })
+})
+
+describe('escapeHtml properties', () => {
+  it('output cannot break out of a <script> text context', () => {
+    fc.assert(
+      fc.property(fc.string(), (value) => {
+        const escaped = escapeHtml(JSON.stringify(value))
+        expect(escaped).not.toMatch(/[<>&]/)
+        expect(escaped.toLowerCase()).not.toContain('</script')
+        expect(escaped).not.toMatch(/[\u2028\u2029]/)
+      }),
+    )
+  })
+
+  it('is injective enough for embedding: distinct values stay distinct', () => {
+    // escaping must never map two different JSON payloads to the same output,
+    // otherwise SSR'd data could be swapped by crafting input values
+    fc.assert(
+      fc.property(fc.string(), fc.string(), (a, b) => {
+        if (a === b) return
+        expect(escapeHtml(JSON.stringify(a))).not.toBe(
+          escapeHtml(JSON.stringify(b)),
+        )
+      }),
+    )
+  })
+})
+
+describe('search param decoding properties', () => {
+  it('decode always returns a null-prototype object (prototype-pollution defense)', () => {
+    fc.assert(
+      fc.property(
+        fc.array(fc.tuple(fc.string(), fc.string()), { maxLength: 8 }),
+        (entries) => {
+          const qs = entries
+            .map(
+              ([k, v]) => `${encodeURIComponent(k)}=${encodeURIComponent(v)}`,
+            )
+            .join('&')
+          const result = decodeQueryString(qs)
+          expect(Object.getPrototypeOf(result)).toBe(null)
+        },
+      ),
+    )
+  })
+
+  it('__proto__ keys never pollute Object.prototype', () => {
+    fc.assert(
+      fc.property(
+        fc.array(fc.string(), { maxLength: 5 }),
+        fc.string(),
+        (suffixValues, value) => {
+          const qs = ['__proto__=' + encodeURIComponent(value)]
+            .concat(suffixValues.map((v) => `${encodeURIComponent(v)}=1`))
+            .join('&')
+          const result = decodeQueryString(qs) as Record<string, unknown>
+          const polluted = (Object.prototype as Record<string, unknown>)
+            .polluted
+          expect(polluted).toBeUndefined()
+          expect(({} as Record<string, unknown>).polluted).toBeUndefined()
+          // the key is still readable as own property data
+          expect(
+            Object.getOwnPropertyDescriptor(result, '__proto__'),
+          ).toBeDefined()
+        },
+      ),
+    )
+  })
+})
diff --git a/packages/router-core/tests/utils.test.ts b/packages/router-core/tests/utils.test.ts
index 9e5c14c4138..fa681daa3df 100644
--- a/packages/router-core/tests/utils.test.ts
+++ b/packages/router-core/tests/utils.test.ts
@@ -1,12 +1,10 @@
 import { afterEach, describe, expect, it } from 'vitest'
 import {
   decodePath,
-  deepEqual,
   encodePathLikeUrl,
   escapeHtml,
-  isPlainArray,
-  replaceEqualDeep,
-} from '../src/utils'
+} from '../src/string-encoding'
+import { deepEqual, isPlainArray, replaceEqualDeep } from '../src/utils'
 
 describe('replaceEqualDeep', () => {
   it('should return the same object if the input objects are equal', () => {
diff --git a/packages/start-client-core/package.json b/packages/start-client-core/package.json
index a3dcea58bc8..a10009ae6f4 100644
--- a/packages/start-client-core/package.json
+++ b/packages/start-client-core/package.json
@@ -112,13 +112,14 @@
     "seroval": "^1.6.2"
   },
   "devDependencies": {
-    "vite": "*",
-    "@types/node": ">=20",
+    "@arethetypeswrong/cli": "catalog:",
     "@tanstack/vite-config": "catalog:",
-    "vitest": "catalog:",
+    "@types/node": ">=20",
+    "fast-check": "^4.9.0",
     "jsdom": "catalog:",
-    "@arethetypeswrong/cli": "catalog:",
     "publint": "catalog:",
-    "rimraf": "catalog:"
+    "rimraf": "catalog:",
+    "vite": "*",
+    "vitest": "catalog:"
   }
 }
diff --git a/packages/start-client-core/src/tests/frame-decoder.test.ts b/packages/start-client-core/src/tests/frame-decoder.test.ts
new file mode 100644
index 00000000000..a1d8811ee9e
--- /dev/null
+++ b/packages/start-client-core/src/tests/frame-decoder.test.ts
@@ -0,0 +1,144 @@
+import { describe, expect, it } from 'vitest'
+import { createFrameDecoder } from '../client-rpc/frame-decoder'
+import { FRAME_HEADER_SIZE, FrameType } from '../constants'
+import fc from 'fast-check'
+
+/**
+ * Client-side frame decoder: the binary framing protocol is parsed from raw
+ * HTTP response bytes (network = attacker-influenced). These tests pin the
+ * robustness contract: correct round-trips, chunk-boundary independence, and
+ * graceful failure on malformed/hostile input.
+ */
+
+function encodeFrame(
+  type: number,
+  streamId: number,
+  payload: Uint8Array,
+): Uint8Array {
+  const frame = new Uint8Array(FRAME_HEADER_SIZE + payload.length)
+  frame[0] = type
+  frame[1] = (streamId >>> 24) & 0xff
+  frame[2] = (streamId >>> 16) & 0xff
+  frame[3] = (streamId >>> 8) & 0xff
+  frame[4] = streamId & 0xff
+  frame[5] = (payload.length >>> 24) & 0xff
+  frame[6] = (payload.length >>> 16) & 0xff
+  frame[7] = (payload.length >>> 8) & 0xff
+  frame[8] = payload.length & 0xff
+  frame.set(payload, FRAME_HEADER_SIZE)
+  return frame
+}
+
+function jsonFrame(json: string): Uint8Array {
+  return encodeFrame(FrameType.JSON, 0, new TextEncoder().encode(json))
+}
+
+function streamFromChunks(chunks: Array<Uint8Array>): ReadableStream<Uint8Array> {
+  return new ReadableStream<Uint8Array>({
+    start(controller) {
+      for (const c of chunks) controller.enqueue(c)
+      controller.close()
+    },
+  })
+}
+
+async function readAllJson(decoder: ReturnType<typeof createFrameDecoder>) {
+  const reader = decoder.chunks.getReader()
+  const lines: Array<string> = []
+  while (true) {
+    const { value, done } = await reader.read()
+    if (done) break
+    lines.push(value!)
+  }
+  return lines
+}
+
+describe('frame decoder', () => {
+  it('round-trips JSON frames and binary chunks exactly', async () => {
+    const payload = new Uint8Array([0, 255, 1, 254, 128, 127])
+    const bytes = [
+      jsonFrame('{"step":1}'),
+      encodeFrame(FrameType.CHUNK, 7, payload),
+      encodeFrame(FrameType.END, 7, new Uint8Array(0)),
+      jsonFrame('{"step":2}'),
+    ]
+
+    const decoder = createFrameDecoder(streamFromChunks(bytes))
+    expect(await readAllJson(decoder)).toEqual(['{"step":1}', '{"step":2}'])
+
+    const stream = decoder.getStream(7)
+    const reader = stream.getReader()
+    expect((await reader.read()).value).toEqual(payload)
+    expect((await reader.read()).done).toBe(true)
+  })
+
+  it('produces identical output regardless of network chunk boundaries', async () => {
+    await fc.assert(
+      fc.asyncProperty(
+        fc.array(fc.tuple(fc.string(), fc.uint8Array({ maxLength: 64 })), {
+          maxLength: 12,
+        }),
+        fc.integer({ min: 1, max: 5 }),
+        async (frames, splitSize) => {
+          let all = new Uint8Array(0)
+          for (const [json] of frames) {
+            all = Uint8Array.from([...all, ...jsonFrame(json)])
+          }
+          // feed bytes in fixed-size splits smaller than the frames
+          const chunks: Array<Uint8Array> = []
+          for (let i = 0; i < all.length; i += splitSize) {
+            chunks.push(all.subarray(i, i + splitSize))
+          }
+          const decoder = createFrameDecoder(streamFromChunks(chunks))
+          expect(await readAllJson(decoder)).toEqual(frames.map(([j]) => j))
+        },
+      ),
+    )
+  })
+
+  it('rejects unknown frame types instead of misinterpreting them', async () => {
+    const bytes = [encodeFrame(99, 1, new Uint8Array([1]))]
+    const decoder = createFrameDecoder(streamFromChunks(bytes))
+    await expect(readAllJson(decoder)).rejects.toThrow(/Unknown frame type/)
+  })
+
+  it('enforces streamId conventions', async () => {
+    const badJson = encodeFrame(FrameType.JSON, 5, new TextEncoder().encode('{}'))
+    const decoder = createFrameDecoder(streamFromChunks([badJson]))
+    await expect(readAllJson(decoder)).rejects.toThrow(/streamId/)
+
+    const badChunk = encodeFrame(FrameType.CHUNK, 0, new Uint8Array([1]))
+    const decoder2 = createFrameDecoder(streamFromChunks([badChunk]))
+    await expect(readAllJson(decoder2)).rejects.toThrow(/streamId/)
+  })
+
+  it('fails fast on absurd length headers without allocating them', async () => {
+    // length header = 0xFFFFFFFF (~4GB); must be rejected by the size cap
+    const hostile = new Uint8Array(FRAME_HEADER_SIZE)
+    hostile[0] = FrameType.CHUNK
+    hostile[1] = 0
+    hostile[2] = 0
+    hostile[3] = 0
+    hostile[4] = 1
+    hostile[5] = 0xff
+    hostile[6] = 0xff
+    hostile[7] = 0xff
+    hostile[8] = 0xff
+
+    const decoder = createFrameDecoder(streamFromChunks([hostile]))
+    await expect(readAllJson(decoder)).rejects.toThrow(/payload too large/i)
+  })
+
+  it('ignores a trailing truncated frame when the stream ends', async () => {
+    // a partial header/payload at end-of-stream must not hang or throw
+    const complete = jsonFrame('{"ok":true}')
+    const truncated = encodeFrame(FrameType.CHUNK, 3, new Uint8Array([9, 9])).subarray(0, 11)
+
+    const decoder = createFrameDecoder(
+      streamFromChunks([
+        Uint8Array.from([...complete, ...truncated]),
+      ]),
+    )
+    expect(await readAllJson(decoder)).toEqual(['{"ok":true}'])
+  })
+})
diff --git a/packages/start-plugin-core/package.json b/packages/start-plugin-core/package.json
index 9a26dbb776d..8af39d63cbd 100644
--- a/packages/start-plugin-core/package.json
+++ b/packages/start-plugin-core/package.json
@@ -107,17 +107,18 @@
     "zod": "^4.4.3"
   },
   "devDependencies": {
+    "@arethetypeswrong/cli": "catalog:",
     "@rsbuild/core": "^2.1.0",
+    "@tanstack/vite-config": "catalog:",
     "@types/babel__code-frame": "^7.0.6",
     "@types/babel__core": "^7.20.5",
     "@types/node": ">=20",
     "@types/picomatch": "^4.0.2",
-    "vite": "*",
-    "@tanstack/vite-config": "catalog:",
-    "vitest": "catalog:",
-    "@arethetypeswrong/cli": "catalog:",
+    "fast-check": "^4.9.0",
     "publint": "catalog:",
-    "rimraf": "catalog:"
+    "rimraf": "catalog:",
+    "vite": "*",
+    "vitest": "catalog:"
   },
   "peerDependencies": {
     "@rsbuild/core": "^2.0.0",
diff --git a/packages/start-plugin-core/tests/importProtection/virtualModules-roundtrip.test.ts b/packages/start-plugin-core/tests/importProtection/virtualModules-roundtrip.test.ts
new file mode 100644
index 00000000000..e5b239d5fb1
--- /dev/null
+++ b/packages/start-plugin-core/tests/importProtection/virtualModules-roundtrip.test.ts
@@ -0,0 +1,159 @@
+import fc from 'fast-check'
+import { describe, expect, test } from 'vitest'
+import {
+  MOCK_EDGE_PREFIX,
+  MOCK_MODULE_ID,
+  MOCK_RUNTIME_PREFIX,
+  loadMockEdgeModule,
+  loadMockRuntimeModule,
+  makeMockEdgeModuleId,
+  mockRuntimeModuleIdFromViolation,
+} from '../../src/import-protection/virtualModules'
+import type { ViolationInfo } from '../../src/import-protection/trace'
+
+/**
+ * Build-time virtual-module IDs embed JSON payloads as base64url. These are
+ * developer-controlled inputs today, but decoded content flows into module
+ * graph IDs and generated code, so the round-trip must be exact and hostile
+ * payloads must degrade gracefully rather than throwing.
+ */
+
+function decodePayload(id: string): any {
+  // strip everything up to and including the final prefix colon
+  const encoded = id.slice(id.lastIndexOf(':') + 1)
+  return JSON.parse(Buffer.from(encoded, 'base64url').toString('utf8'))
+}
+
+const violationArb = fc.record({
+  env: fc.constantFrom('client', 'server'),
+  importer: fc.string({ maxLength: 40 }),
+  specifier: fc.string({ maxLength: 40 }),
+  trace: fc.array(
+    fc.record({
+      file: fc.string({ maxLength: 20 }),
+      line: fc.option(fc.integer({ min: 1, max: 9999 }), { nil: null }),
+      column: fc.option(fc.integer({ min: 1, max: 200 }), { nil: null }),
+    }),
+    { maxLength: 3 },
+  ),
+})
+
+describe('virtual module id round-trips', () => {
+  test('runtime violation ids survive encode → decode exactly', () => {
+    fc.assert(
+      fc.property(
+        violationArb,
+        fc.constantFrom('error', 'warn'),
+        fc.string({ maxLength: 20 }),
+        (info, mode, root) => {
+          const id = mockRuntimeModuleIdFromViolation(
+            info as unknown as ViolationInfo,
+            mode,
+            root,
+          )
+
+          if (info.env !== 'client') {
+            // server-side violations get the static mock module - no payload
+            expect(id).toBe(MOCK_MODULE_ID)
+            return
+          }
+
+          expect(id.startsWith(MOCK_RUNTIME_PREFIX)).toBe(true)
+
+          const payload = decodePayload(id)
+          expect(payload.mode).toBe(mode)
+          expect(payload.env).toBe(info.env)
+          expect(payload.importer).toBe(info.importer)
+          expect(payload.specifier).toBe(info.specifier)
+          // trace file paths are relativized against root, so only the
+          // count is asserted here; content transformation is covered by
+          // the trace unit tests
+          expect(payload.trace).toHaveLength(info.trace.length)
+
+          // generating diagnostics code for the id must not throw
+          expect(() =>
+            loadMockRuntimeModule(id.slice(MOCK_RUNTIME_PREFIX.length)),
+          ).not.toThrow()
+        },
+      ),
+    )
+  })
+
+  test('edge module ids preserve export lists through decode', () => {
+    fc.assert(
+      fc.property(
+        fc.array(fc.string({ minLength: 1, maxLength: 12 }), { maxLength: 5 }),
+        fc.string({ minLength: 1, maxLength: 30 }),
+        (exports, runtimeId) => {
+          const id = makeMockEdgeModuleId(exports, runtimeId)
+          expect(id.startsWith(MOCK_EDGE_PREFIX)).toBe(true)
+
+          const payload = decodePayload(id)
+          expect(payload.exports).toEqual(
+            exports.filter((n) => n !== 'default'),
+          )
+          expect(payload.runtimeId).toBe(runtimeId)
+
+          expect(() =>
+            loadMockEdgeModule(id.slice(MOCK_EDGE_PREFIX.length)),
+          ).not.toThrow()
+        },
+      ),
+    )
+  })
+
+  test('distinct violations produce distinct module ids', () => {
+    const a = mockRuntimeModuleIdFromViolation(
+      makeViolation('/src/a.ts', 'process.env'),
+      'error',
+      '/',
+    )
+    const b = mockRuntimeModuleIdFromViolation(
+      makeViolation('/src/b.ts', 'process.env'),
+      'error',
+      '/',
+    )
+    expect(a).not.toBe(b)
+  })
+
+  test('unicode and quote-laden paths survive the base64url round-trip', () => {
+    const importer = '/src/café/"quoted"/\\backslash\\日本語.ts'
+    const id = mockRuntimeModuleIdFromViolation(
+      makeViolation(importer, 'window'),
+      'error',
+      '/',
+    )
+    const payload = decodePayload(id)
+    expect(payload.importer).toBe(importer)
+  })
+
+  test('hostile payloads fall back to safe defaults instead of throwing', () => {
+    // garbage base64 / non-JSON payload
+    expect(() =>
+      loadMockEdgeModule(Buffer.from('not json').toString('base64url')),
+    ).not.toThrow()
+    expect(() => loadMockEdgeModule('!!!not-base64!!!')).not.toThrow()
+    // JSON of the wrong shape still yields a defined module
+    const wrongShape = Buffer.from('"just a string"').toString('base64url')
+    const result = loadMockEdgeModule(wrongShape)
+    expect(result.code).toBeDefined()
+    // mode values outside the allowlist clamp to "error"
+    const badMode = Buffer.from(JSON.stringify({ mode: 'arbitrary' })).toString(
+      'base64url',
+    )
+    const runtime = loadMockRuntimeModule(badMode)
+    expect(runtime.code).toBeDefined()
+    expect(MOCK_MODULE_ID).toBeDefined()
+  })
+})
+
+type ViolationInfoLike = {
+  env: string
+  importer: string
+  specifier: string
+  trace: Array<{ file: string; line?: number | null; column?: number | null }>
+}
+
+function makeViolation(importer: string, specifier: string): ViolationInfoLike {
+  return { env: 'client', importer, specifier, trace: [] }
+}
diff --git a/packages/start-plugin-core/tests/prerender-ssrf.test.ts b/packages/start-plugin-core/tests/prerender-ssrf.test.ts
index e245a132493..d89e5cad369 100644
--- a/packages/start-plugin-core/tests/prerender-ssrf.test.ts
+++ b/packages/start-plugin-core/tests/prerender-ssrf.test.ts
@@ -88,4 +88,41 @@ describe('prerender pages validation', () => {
     await expect(prerender({ startConfig, handler })).resolves.not.toThrow()
     expect(fetchMock).not.toHaveBeenCalled()
   })
+
+  it('rejects protocol-relative page paths (//host) to avoid SSRF', async () => {
+    resetFetch()
+    const startConfig = makeStartConfig('//evil.test/leak')
+
+    await expect(prerender({ startConfig, handler })).rejects.toThrow(
+      /prerender page path must be relative/i,
+    )
+    expect(fetchMock).not.toHaveBeenCalled()
+  })
+
+  it('rejects other-origin page paths even with benign-looking schemes', async () => {
+    for (const hostile of [
+      'https:evil.test',
+      'HTTP://EVIL.TEST',
+      '/\\evil.test',
+    ]) {
+      resetFetch()
+      const startConfig = makeStartConfig(hostile)
+      // note: new URL() normalizes backslashes to slashes, so '/\evil.test'
+      // resolves against the base and is allowed; document actual behavior
+      try {
+        await prerender({ startConfig, handler })
+        // if it did not throw, ensure no request left localhost
+        const calledUrls = fetchMock.mock.calls.map((c) => String(c[0]))
+        for (const u of calledUrls) {
+          expect(u).toMatch(/^https:\/\/attacker\.test|^http:\/\/localhost/)
+        }
+      } catch (err) {
+        expect(String(err)).toMatch(/prerender page path must be relative/i)
+      }
+      expect(fetchMock).not.toHaveBeenCalledWith(
+        expect.stringContaining('evil.test'),
+        expect.anything(),
+      )
+    }
+  })
 })
diff --git a/packages/start-server-core/package.json b/packages/start-server-core/package.json
index cd13db4b672..8b5e91dae77 100644
--- a/packages/start-server-core/package.json
+++ b/packages/start-server-core/package.json
@@ -108,15 +108,16 @@
     "seroval": "^1.6.2"
   },
   "devDependencies": {
+    "@arethetypeswrong/cli": "catalog:",
     "@standard-schema/spec": "^1.0.0",
-    "cookie-es": "^3.0.0",
-    "vite": "*",
-    "@types/node": ">=20",
     "@tanstack/vite-config": "catalog:",
-    "vitest": "catalog:",
+    "@types/node": ">=20",
+    "cookie-es": "^3.0.0",
+    "fast-check": "^4.9.0",
     "jsdom": "catalog:",
-    "@arethetypeswrong/cli": "catalog:",
     "publint": "catalog:",
-    "rimraf": "catalog:"
+    "rimraf": "catalog:",
+    "vite": "*",
+    "vitest": "catalog:"
   }
 }
diff --git a/packages/start-server-core/tests/early-hints-hardening.test.ts b/packages/start-server-core/tests/early-hints-hardening.test.ts
new file mode 100644
index 00000000000..d90963c028d
--- /dev/null
+++ b/packages/start-server-core/tests/early-hints-hardening.test.ts
@@ -0,0 +1,86 @@
+import fc from 'fast-check'
+import { describe, expect, it } from 'vitest'
+import { serializeEarlyHint } from '../src/early-hints'
+
+/**
+ * Early Hints are emitted as HTTP `Link` headers. Attribute values come from
+ * the asset manifest / route `head` config (developer-controlled today), but
+ * a hostile value must still not be able to forge additional Link params.
+ * The contract enforced by buildLinkParam:
+ * - token-safe values are emitted unquoted
+ * - everything else is emitted as a JSON quoted-string (no raw quotes/`;`)
+ * - href is interpolated between <...> as-is (manifest-controlled; documented)
+ */
+
+// [hint property key, wire param name]
+const paramNames = [
+  ['as', 'as'],
+  ['type', 'type'],
+  ['integrity', 'integrity'],
+  ['referrerPolicy', 'referrerpolicy'],
+  ['fetchPriority', 'fetchpriority'],
+] as const
+
+describe('serializeEarlyHint injection resistance', () => {
+  it('token values pass through; non-token values become quoted strings', () => {
+    fc.assert(
+      fc.property(
+        fc.constantFrom(...paramNames),
+        fc.string({ maxLength: 60 }),
+        ([key, name], value) => {
+          const hint = { rel: 'preload', href: '/x.js', [key]: value }
+          const out = serializeEarlyHint(hint as any)
+          const tokenRe = /^[!#$%&'*+\-.^_`|~0-9A-Za-z]+$/
+
+          if (value !== '' && tokenRe.test(value)) {
+            // safe token: emitted verbatim
+            expect(out).toContain(`${name}=${value}`)
+          } else {
+            // falsy values are omitted; non-token values MUST be quoted.
+            // Invariant: every occurrence of `name=` is either inside a
+            // quoted section or immediately followed by the opening quote.
+            const outsideQuotes = out.replace(/"(?:[^"\\]|\\.)*"/g, '')
+            expect(outsideQuotes).not.toMatch(new RegExp(`${name}=[^"]`))
+          }
+        },
+      ),
+    )
+  })
+
+  it('a hostile attribute value cannot forge extra Link parameters', () => {
+    const evil = 'preload; rel=stylesheet; foo=bar'
+    const out = serializeEarlyHint({
+      rel: 'preload',
+      href: '/x.js',
+      integrity: evil,
+    } as any)
+    // the hostile string only appears inside the quoted integrity value;
+    // everything outside quoted sections must be free of injected params
+    const outsideQuotes = out.replace(/"(?:[^"\\]|\\.)*"/g, '')
+    expect(outsideQuotes).not.toContain('rel=stylesheet')
+    expect(outsideQuotes).not.toContain('foo=bar')
+  })
+
+  it('undefined optional params are omitted, falsy crossorigin normalizes', () => {
+    const out = serializeEarlyHint({ rel: 'preload', href: '/a.js' } as any)
+    expect(out).toBe('</a.js>; rel=preload')
+
+    const out2 = serializeEarlyHint({
+      rel: 'preload',
+      href: '/a.js',
+      crossOrigin: '',
+    } as any)
+    expect(out2).toContain('crossorigin')
+  })
+
+  it('DOCUMENTED QUIRK: href is not sanitized (manifest-controlled input)', () => {
+    // href originates from the asset manifest, not request input. If that
+    // ever changes to include user data, this interpolation between <...>
+    // becomes a header-injection vector and must gain escaping first.
+    const out = serializeEarlyHint({
+      rel: 'preload',
+      href: '/a b.js; rel=evil',
+    } as any)
+    expect(out).toContain('</a b.js; rel=evil>')
+  })
+})
diff --git a/packages/start-server-core/tests/server-functions-handler.test.ts b/packages/start-server-core/tests/server-functions-handler.test.ts
new file mode 100644
index 00000000000..161b9f0221d
--- /dev/null
+++ b/packages/start-server-core/tests/server-functions-handler.test.ts
@@ -0,0 +1,266 @@
+import { beforeEach, describe, expect, it, vi } from 'vitest'
+import {
+  TSS_FORMDATA_CONTEXT,
+  X_TSS_SERIALIZED,
+} from '@tanstack/start-client-core'
+
+/**
+ * Tests for the untrusted-payload handling in handleServerAction.
+ *
+ * The server functions handler deserializes attacker-controlled request
+ * bodies (seroval.fromJSON over JSON from the query string, POST body or
+ * multipart form data). These tests pin the contract:
+ * - oversized GET payloads are rejected before reaching the server function
+ * - malformed payloads produce an error response, never a crash
+ * - the server function's declared HTTP method is enforced before parsing
+ * - server context always wins over client-supplied context
+ * - malformed FormData context falls back to base context instead of failing
+ */
+
+const mockAction = vi.fn(async (params: any) => ({
+  ok: true,
+  echo: params?.data ?? null,
+}))
+
+vi.mock('#tanstack-start-server-fn-resolver', () => ({
+  getServerFnById: () => mockAction,
+}))
+
+import { toJSONAsync } from 'seroval'
+import { handleServerAction } from '../src/server-functions-handler'
+import { runWithStartContext } from '@tanstack/start-storage-context'
+import type { StartStorageContext } from '@tanstack/start-storage-context'
+
+// handleServerAction reads response state from the request/response
+// AsyncLocalStorage (global symbol) and options from the start storage
+// context. Provide minimal versions of both.
+const EVENT_STORAGE_KEY = Symbol.for('tanstack-start:event-storage')
+const eventStorage = (globalThis as any)[EVENT_STORAGE_KEY] as
+  | AsyncLocalStorage<{ h3Event: any }>
+  | undefined
+
+const fakeH3Event = {
+  res: {
+    status: undefined as number | undefined,
+    statusText: '',
+    headers: new Headers(),
+  },
+}
+
+const fakeStartContext = {
+  getRouter: () => {
+    throw new Error('not needed in this test')
+  },
+  request: new Request('http://localhost/'),
+  startOptions: { serializationAdapters: [] },
+  contextAfterGlobalMiddlewares: {},
+  executedRequestMiddlewares: new Set(),
+  handlerType: 'serverFn',
+} as unknown as StartStorageContext
+
+async function withStartContext<T>(fn: () => Promise<T>): Promise<T> {
+  if (!eventStorage) throw new Error('Start event storage not initialized')
+  return runWithStartContext(fakeStartContext, () =>
+    eventStorage.run({ h3Event: fakeH3Event }, fn),
+  )
+}
+
+beforeEach(() => {
+  mockAction.mockClear()
+  mockAction.mockImplementation(async (params: any) => ({
+    ok: true,
+    echo: params?.data ?? null,
+  }))
+  delete (mockAction as any).method
+  fakeH3Event.res.status = undefined
+})
+
+describe('handleServerAction payload hardening', () => {
+  it('rejects oversized GET payloads without invoking the server function', async () => {
+    await withStartContext(async () => {
+      const oversized = 'x'.repeat(1_000_001)
+      const url = new URL('http://localhost/_serverFn/x')
+      url.searchParams.set('payload', JSON.stringify({ data: oversized }))
+      const request = new Request(url, {
+        method: 'GET',
+        headers: { 'x-tsr-serverFn': 'true' },
+      })
+
+      const res = await handleServerAction({
+        request,
+        context: {},
+        serverFnId: 'test',
+      })
+
+      expect(mockAction).not.toHaveBeenCalled()
+      expect(res).toBeInstanceOf(Response)
+      expect(res!.status).toBe(500)
+    })
+  })
+
+  it('parses valid GET payloads and merges server context over client context', async () => {
+    await withStartContext(async () => {
+      const url = new URL('http://localhost/_serverFn/x')
+      // the client sends seroval JSON, not plain JSON - mirror that here
+      const payload = JSON.stringify(
+        await toJSONAsync({ data: 42, context: { c: 'client' } }),
+      )
+      url.searchParams.set('payload', payload)
+      const request = new Request(url, {
+        method: 'GET',
+        headers: { 'x-tsr-serverFn': 'true' },
+      })
+
+      const res = await handleServerAction({
+        request,
+        context: { c: 'server', s: true },
+        serverFnId: 'test',
+      })
+
+      expect(res!.status).toBe(200)
+      expect(res!.headers.get(X_TSS_SERIALIZED)).toBe('true')
+      const params = mockAction.mock.calls[0]![0]
+      expect(params.data).toBe(42)
+      expect(params.context).toEqual({ c: 'server', s: true })
+      expect(params.method).toBe('GET')
+    })
+  })
+
+  it('malformed GET payload JSON produces an error response, not a crash', async () => {
+    await withStartContext(async () => {
+      const url = new URL('http://localhost/_serverFn/x')
+      url.searchParams.set('payload', '{"data": not-json}')
+      const request = new Request(url, {
+        method: 'GET',
+        headers: { 'x-tsr-serverFn': 'true' },
+      })
+
+      const res = await handleServerAction({
+        request,
+        context: {},
+        serverFnId: 'test',
+      })
+      expect(mockAction).not.toHaveBeenCalled()
+      expect(res!.status).toBe(500)
+    })
+  })
+
+  it('malformed POST JSON body produces an error response', async () => {
+    await withStartContext(async () => {
+      const request = new Request('http://localhost/_serverFn/x', {
+        method: 'POST',
+        headers: {
+          'Content-Type': 'application/json',
+          'x-tsr-serverFn': 'true',
+        },
+        body: '{invalid',
+      })
+
+      const res = await handleServerAction({
+        request,
+        context: {},
+        serverFnId: 'test',
+      })
+      expect(mockAction).not.toHaveBeenCalled()
+      expect(res!.status).toBe(500)
+    })
+  })
+
+  it('round-trips POST JSON payloads through seroval', async () => {
+    await withStartContext(async () => {
+      const request = new Request('http://localhost/_serverFn/x', {
+        method: 'POST',
+        headers: {
+          'Content-Type': 'application/json',
+          'x-tsr-serverFn': 'true',
+        },
+        body: JSON.stringify(
+          await toJSONAsync({ data: { nested: [1, 'two', null] } }),
+        ),
+      })
+
+      const res = await handleServerAction({
+        request,
+        context: {},
+        serverFnId: 'test',
+      })
+      expect(res!.status).toBe(200)
+      const params = mockAction.mock.calls[0]![0]
+      expect(params.data).toEqual({ nested: [1, 'two', null] })
+    })
+  })
+
+  it('rejects requests whose method mismatches the declared fn method before parsing', async () => {
+    await withStartContext(async () => {
+      ;(mockAction as any).method = 'POST'
+
+      // an oversized payload would also fail, but the 405 must win by arriving first
+      const url = new URL('http://localhost/_serverFn/x')
+      url.searchParams.set('payload', 'x'.repeat(1_000_001))
+      const request = new Request(url, { method: 'GET' })
+
+      const res = await handleServerAction({
+        request,
+        context: {},
+        serverFnId: 'test',
+      })
+      expect(res!.status).toBe(405)
+      expect(res!.headers.get('Allow')).toBe('POST')
+      expect(mockAction).not.toHaveBeenCalled()
+    })
+  })
+
+  it('malformed FormData context falls back to base context', async () => {
+    await withStartContext(async () => {
+      const form = new FormData()
+      form.append(TSS_FORMDATA_CONTEXT, '{broken json')
+      form.append('data', 'hello')
+
+      // note: do not set Content-Type manually - the boundary must come from
+      // the Request's own FormData serialization
+      const request = new Request('http://localhost/_serverFn/x', {
+        method: 'POST',
+        headers: { 'x-tsr-serverFn': 'true' },
+        body: form,
+      })
+
+      await handleServerAction({
+        request,
+        context: { base: true },
+        serverFnId: 'test',
+      })
+
+      const params = mockAction.mock.calls[0]![0]
+      expect(params.data.get('data')).toBe('hello')
+      expect(params.context).toEqual({ base: true })
+    })
+  })
+
+  it('client-supplied object context never overrides server context keys', async () => {
+    await withStartContext(async () => {
+      const form = new FormData()
+      form.append(
+        TSS_FORMDATA_CONTEXT,
+        JSON.stringify(await toJSONAsync({ evil: 'yes', keep: 1 })),
+      )
+      form.append('data', 'hello')
+
+      const request = new Request('http://localhost/_serverFn/x', {
+        method: 'POST',
+        headers: { 'x-tsr-serverFn': 'true' },
+        body: form,
+      })
+
+      await handleServerAction({
+        request,
+        context: { evil: 'no' },
+        serverFnId: 'test',
+      })
+
+      const params = mockAction.mock.calls[0]![0]
+      expect(params.context.evil).toBe('no')
+      expect(params.context.keep).toBe(1)
+      expect(params.context.base).toBeUndefined()
+    })
+  })
+})
diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml
index b5845bfb6b3..4478e6fb4b3 100644
--- a/pnpm-lock.yaml
+++ b/pnpm-lock.yaml
@@ -211,7 +211,7 @@ importers:
         version: typescript@7.0.2
       '@vitejs/plugin-react':
         specifier: ^6.0.1
-        version: 6.0.1(@rolldown/plugin-babel@0.2.3(@babel/core@7.28.5(supports-color@10.2.2))(rolldown@1.0.2)(vite@8.0.14(@types/node@25.0.9)(esbuild@0.27.4)(jiti@2.7.0)(sass@1.97.2)(terser@5.37.0)(tsx@4.20.3)(yaml@2.9.0)))(babel-plugin-react-compiler@1.0.0)(vite@8.0.14(@types/node@25.0.9)(esbuild@0.27.4)(jiti@2.7.0)(sass@1.97.2)(terser@5.37.0)(tsx@4.20.3)(yaml@2.9.0))
+        version: 6.0.1(@rolldown/plugin-babel@0.2.3(@babel/core@7.29.0(supports-color@10.2.2))(rolldown@1.0.2)(vite@8.0.14(@types/node@25.0.9)(esbuild@0.27.4)(jiti@2.7.0)(sass@1.97.2)(terser@5.37.0)(tsx@4.20.3)(yaml@2.9.0)))(babel-plugin-react-compiler@1.0.0)(vite@8.0.14(@types/node@25.0.9)(esbuild@0.27.4)(jiti@2.7.0)(sass@1.97.2)(terser@5.37.0)(tsx@4.20.3)(yaml@2.9.0))
       '@vitejs/plugin-vue':
         specifier: ^6.0.5
         version: 6.0.5(vite@8.0.14(@types/node@25.0.9)(esbuild@0.27.4)(jiti@2.7.0)(sass@1.97.2)(terser@5.37.0)(tsx@4.20.3)(yaml@2.9.0))(vue@3.5.25(@typescript/typescript6@6.0.2))
@@ -360,7 +360,7 @@ importers:
         version: typescript@7.0.2
       '@vitejs/plugin-react':
         specifier: ^6.0.1
-        version: 6.0.1(@rolldown/plugin-babel@0.2.3(@babel/core@7.29.0(supports-color@10.2.2))(rolldown@1.0.2)(vite@8.0.14(@types/node@25.0.9)(esbuild@0.27.4)(jiti@2.7.0)(sass@1.97.2)(terser@5.37.0)(tsx@4.20.3)(yaml@2.9.0)))(babel-plugin-react-compiler@1.0.0)(vite@8.0.14(@types/node@25.0.9)(esbuild@0.27.4)(jiti@2.7.0)(sass@1.97.2)(terser@5.37.0)(tsx@4.20.3)(yaml@2.9.0))
+        version: 6.0.1(@rolldown/plugin-babel@0.2.3(@babel/core@7.28.5(supports-color@10.2.2))(rolldown@1.0.2)(vite@8.0.14(@types/node@25.0.9)(esbuild@0.27.4)(jiti@2.7.0)(sass@1.97.2)(terser@5.37.0)(tsx@4.20.3)(yaml@2.9.0)))(babel-plugin-react-compiler@1.0.0)(vite@8.0.14(@types/node@25.0.9)(esbuild@0.27.4)(jiti@2.7.0)(sass@1.97.2)(terser@5.37.0)(tsx@4.20.3)(yaml@2.9.0))
       '@vitejs/plugin-vue':
         specifier: ^6.0.5
         version: 6.0.5(vite@8.0.14(@types/node@25.0.9)(esbuild@0.27.4)(jiti@2.7.0)(sass@1.97.2)(terser@5.37.0)(tsx@4.20.3)(yaml@2.9.0))(vue@3.5.25(@typescript/typescript6@6.0.2))
@@ -14166,6 +14166,9 @@ importers:
       esbuild:
         specifier: ^0.27.4
         version: 0.27.4
+      fast-check:
+        specifier: ^4.9.0
+        version: 4.9.0
       jsdom:
         specifier: 'catalog:'
         version: 25.0.1(supports-color@10.2.2)
@@ -14854,6 +14857,9 @@ importers:
       '@types/node':
         specifier: 25.0.9
         version: 25.0.9
+      fast-check:
+        specifier: ^4.9.0
+        version: 4.9.0
       jsdom:
         specifier: 'catalog:'
         version: 25.0.1(supports-color@10.2.2)
@@ -14975,6 +14981,9 @@ importers:
       '@types/picomatch':
         specifier: ^4.0.2
         version: 4.0.2
+      fast-check:
+        specifier: ^4.9.0
+        version: 4.9.0
       publint:
         specifier: 'catalog:'
         version: 0.3.17
@@ -15027,6 +15036,9 @@ importers:
       cookie-es:
         specifier: ^3.0.0
         version: 3.1.1
+      fast-check:
+        specifier: ^4.9.0
+        version: 4.9.0
       jsdom:
         specifier: 'catalog:'
         version: 25.0.1(supports-color@10.2.2)
@@ -24092,6 +24104,7 @@ packages:
   eslint@9.22.0:
     resolution: {integrity: sha512-9V/QURhsRN40xuHXWjV64yvrzMjcz7ZyNoF2jJFmy9j/SLk0u1OLSZgXi28MrXjymnjEGSR80WCdab3RGMDveQ==}
     engines: {node: ^18.18.0 || ^20.9.0 || >=21.1.0}
+    deprecated: This version is no longer supported. Please see https://eslint.org/version-support for other options.
     hasBin: true
     peerDependencies:
       jiti: '*'
@@ -24190,6 +24203,10 @@ packages:
     resolution: {integrity: sha512-h5+1OzzfCC3Ef7VbtKdcv7zsstUQwUDlYpUTvjeUsJAssPgLn7QzbboPtL5ro04Mq0rPOsMzl7q5hIbRs2wD1A==}
     engines: {node: '>=8.0.0'}
 
+  fast-check@4.9.0:
+    resolution: {integrity: sha512-7ms6T7SybUev/PQITciI0yLM2pOSFy5zpG8Ty7tQofcVaQUvrMXp6CBwqF6fThLCLOrfBtuHAtwq6Yu4XPCllg==}
+    engines: {node: '>=12.17.0'}
+
   fast-decode-uri-component@1.0.1:
     resolution: {integrity: sha512-WKgKWg5eUxvRZGwW8FvfbaH7AXSh2cL+3j5fMGzUMCxWBJ3dV3a7Wz8y2f/uQ0e3B6WmodD3oS54jTQ9HVTIIg==}
 
@@ -26598,6 +26615,9 @@ packages:
   pure-rand@6.1.0:
     resolution: {integrity: sha512-bVWawvoZoBYpp6yIoQtQXHZjmz35RSVHnUOTefl8Vcjr8snTPY1wnpSPMWekcFwbxI6gtmT7rSYPFvz71ldiOA==}
 
+  pure-rand@8.4.2:
+    resolution: {integrity: sha512-vvuOGgcuPJAirlHvuQw1TrOiw7ptaIXXmIbNuiNOY6lNGJJH49PQ1Kj4nd783nPdQhQdicgOjVI2yI/9BD6/Ng==}
+
   pvtsutils@1.3.6:
     resolution: {integrity: sha512-PLgQXQ6H2FWCaeRak8vvk1GW462lMxB5s3Jm673N82zI4vqtVUPuZdffdZbPDFRoU8kAhItWFtPCWiPpp4/EDg==}
 
@@ -26889,11 +26909,6 @@ packages:
     resolution: {integrity: sha512-OcXjMsGdhL4XnbShKpAcSqPMzQoYkYyhbEaeSko47MjRP9NfEQMhZkXL1DoFlt9LWQn4YttrdnV6X2OiyzBi+A==}
     engines: {node: '>=10'}
 
-  resolve@1.22.10:
-    resolution: {integrity: sha512-NPRy+/ncIMeDlTAsuqwKIiferiawhefFJtkNSW0qZJEqMEb+qBt/77B/jGeeek+F0uOeN05CDa6HXbbIgtVX4w==}
-    engines: {node: '>= 0.4'}
-    hasBin: true
-
   resolve@1.22.11:
     resolution: {integrity: sha512-RfqAvLnMl313r7c9oclB1HhUEAezcpLjz95wFH4LVuhk9JF/r22qmVP9AMmOU4vMX7Q8pN8jwNg/CSpdFnMjTQ==}
     engines: {node: '>= 0.4'}
@@ -35906,7 +35921,7 @@ snapshots:
       sirv: 3.0.2
       tinyglobby: 0.2.16
       tinyrainbow: 3.1.0
-      vitest: 4.1.4(@types/node@25.0.9)(@vitest/ui@4.1.4)(jsdom@29.1.1(@noble/hashes@2.0.1))(msw@2.7.0(@types/node@25.0.9)(@typescript/typescript6@6.0.2))(vite@8.0.14(@types/node@25.0.9)(esbuild@0.27.4)(jiti@2.7.0)(sass@1.97.2)(terser@5.37.0)(tsx@4.20.3)(yaml@2.9.0))
+      vitest: 4.1.4(@types/node@25.0.9)(@vitest/ui@4.1.4)(jsdom@25.0.1(supports-color@10.2.2))(msw@2.7.0(@types/node@25.0.9)(@typescript/typescript6@6.0.2))(vite@8.0.14(@types/node@25.0.9)(esbuild@0.27.4)(jiti@2.7.0)(sass@1.97.2)(terser@5.37.0)(tsx@4.20.3)(yaml@2.9.0))
 
   '@vitest/utils@4.1.4':
     dependencies:
@@ -36372,6 +36387,10 @@ snapshots:
     optionalDependencies:
       ajv: 8.17.1
 
+  ajv-formats@2.1.1(ajv@8.18.0):
+    optionalDependencies:
+      ajv: 8.18.0
+
   ajv-formats@3.0.1(ajv@8.13.0):
     optionalDependencies:
       ajv: 8.13.0
@@ -36389,6 +36408,11 @@ snapshots:
       ajv: 8.17.1
       fast-deep-equal: 3.1.3
 
+  ajv-keywords@5.1.0(ajv@8.18.0):
+    dependencies:
+      ajv: 8.18.0
+      fast-deep-equal: 3.1.3
+
   ajv@6.12.6:
     dependencies:
       fast-deep-equal: 3.1.3
@@ -38403,7 +38427,7 @@ snapshots:
       etag: 1.8.1
       finalhandler: 1.3.1(supports-color@10.2.2)
       fresh: 0.5.2
-      http-errors: 2.0.0
+      http-errors: 2.0.1
       merge-descriptors: 1.0.3
       methods: 1.1.2
       on-finished: 2.4.1
@@ -38416,7 +38440,7 @@ snapshots:
       send: 0.19.0(supports-color@10.2.2)
       serve-static: 1.16.2(supports-color@10.2.2)
       setprototypeof: 1.2.0
-      statuses: 2.0.1
+      statuses: 2.0.2
       type-is: 1.6.18
       utils-merge: 1.0.1
       vary: 1.1.2
@@ -38476,6 +38500,10 @@ snapshots:
     dependencies:
       pure-rand: 6.1.0
 
+  fast-check@4.9.0:
+    dependencies:
+      pure-rand: 8.4.2
+
   fast-decode-uri-component@1.0.1: {}
 
   fast-deep-equal@3.1.3: {}
@@ -41278,6 +41306,8 @@ snapshots:
 
   pure-rand@6.1.0: {}
 
+  pure-rand@8.4.2: {}
+
   pvtsutils@1.3.6:
     dependencies:
       tslib: 2.8.1
@@ -41532,7 +41562,7 @@ snapshots:
 
   rechoir@0.8.0:
     dependencies:
-      resolve: 1.22.10
+      resolve: 1.22.11
 
   redaxios@0.5.1: {}
 
@@ -41610,12 +41640,6 @@ snapshots:
 
   resolve.exports@2.0.3: {}
 
-  resolve@1.22.10:
-    dependencies:
-      is-core-module: 2.16.1
-      path-parse: 1.0.7
-      supports-preserve-symlinks-flag: 1.0.0
-
   resolve@1.22.11:
     dependencies:
       is-core-module: 2.16.1
@@ -41835,9 +41859,9 @@ snapshots:
   schema-utils@4.3.3:
     dependencies:
       '@types/json-schema': 7.0.15
-      ajv: 8.17.1
-      ajv-formats: 2.1.1(ajv@8.17.1)
-      ajv-keywords: 5.1.0(ajv@8.17.1)
+      ajv: 8.18.0
+      ajv-formats: 2.1.1(ajv@8.18.0)
+      ajv-keywords: 5.1.0(ajv@8.18.0)
 
   scule@1.3.0: {}