AIKIDO-2026-10784

TL;DR

normalize() and equal() decoded percent-encoded slash and dot segments before dot-segment removal, so encoded sequences could collapse paths the same way literal separators would. Distinct URIs could normalize to the same path and compare equal, weakening checks that rely on normalization or equality over attacker-controlled URLs. The fix preserves reserved percent-escapes in path handling so policy based on normalized paths cannot be bypassed that way.