The reverse proxy and WAF normalize duplicate headers differently, creating a request-smuggling edge case on one legacy route

Most paths are safe, but one parsing mismatch keeps a classic multi-hop ambiguity alive.