CVE-2026-47676: Unsafe Url Pathname Slicecve-2026-47676-unsafe-url-pathname-slice
Directly slicing `url.pathname` with a dynamically calculated index length can result in arbitrary path truncation when requests contain percent-encoded multibyte characters. Because multi-byte characters require more string characters when percent-encoded, a length calculated from a decoded representation will misalign with the encoded representation, causi
