Security
- Reject request URI hosts and
Hostheader values that are not printable ASCII (GHSA-v5mv-p594-2x33) - Reject URI hosts with a percent escape or that are not valid RFC 3986 hosts (GHSA-v5mv-p594-2x33)
- Reject numeric-looking URI hosts with trailing dots, read as IPv4 addresses (GHSA-v5mv-p594-2x33)
- Treat percent-escaped cookie domains as exact-match-only (GHSA-f7vp-7xgx-4w4r)
- Regenerate a derived
Hostheader after client URI rewrites (GHSA-v5mv-p594-2x33)