Security
- Reject non-printable-ASCII and percent-escaped URI hosts and
Hostheaders (GHSA-v5mv-p594-2x33) - Reject request URI hosts that contain a URI authority delimiter (GHSA-v5mv-p594-2x33)
- Reject numeric-looking URI hosts with trailing dots, read as IPv4 addresses (GHSA-v5mv-p594-2x33)
- Treat numeric-in-any-base and percent-escaped cookie domains as exact-match-only (GHSA-f7vp-7xgx-4w4r)
- Regenerate a derived
Hostheader after client URI rewrites (GHSA-v5mv-p594-2x33)
Fixed
- Preserve
RequestExceptionwhen the stream handler rejects a request before opening a stream