AIKIDO-2026-662928

TL;DR

fast-uri only lowercases a percent-decoded host's ASCII letters for schemes that also run full path normalization, and a nested %-escape can still leave the fold incomplete elsewhere. equal() and resolve() therefore treat an encoded host such as a percent-encoded letter in metadata.internal as different from the literal spelling, even though both resolve to the same DNS name. Code that uses equal() or resolve() to allow or block a specific host can be bypassed by percent-encoding a letter in that hostname. The fix folds decoded reg-name characters to lowercase for every scheme before comparison.