The argument turns on %2F, and the spec cuts both ways there. RFC 3986 section 2.3 says normalizers SHOULD decode percent-encodings of unreserved characters [3]. Section 3.3 classifies %2F as reserved, a different thing from the / delimiter [4]. A normalizer that follows section 2.3 literally leaves /%2Fadmin encoded, and a literal ACL comparison against /admin then declines to match a string that is not /admin. What produces the bypass is the backend choosing to decode a reserved delimiter before it routes [1]. Section 6.2.2 is what makes both ends defensible: normalization is optional preprocessing with no required ordering [2]. The ordering silence is real, and the %2F class is additionally two parsers disagreeing about a character the spec put on the keep side of the line [18].
The whole disagreement fits inside one product. With `proxy_pass http://backend/`, nginx decodes and normalizes before forwarding; drop the path from the directive and it forwards the client string unchanged [5]. Same binary. The trailing slash is the security boundary. Gravitee ships RAW, REJECT and NORMALIZE as explicit modes, which is a vendor stating that there is no correct default to inherit [6].
The gateway-versus-backend framing is narrower than the evidence. Spring's CVE-2023-20860 is intra-framework: Spring Security's `mvcRequestMatcher` and the MVC dispatcher read the `**` wildcard differently inside one process [10]. ModSecurity's CVE-2024-1019 decodes %2F before it separates the path from the query string, so a WAF rule inspecting the path component never sees the payload [11]. APISIX's `uri-block` plugin compared `$request_uri` literally, so `//internal/` missed a `^/internal/` rule [12]. Six CVEs, five products, because Apache httpd appears twice [17].
/%252Fadmin is why decoding once is not the fix. The first decode turns %25 into %, producing %2Fadmin, which passes the ACL; the backend's decode produces /admin [14]. Apache showed what string-by-string patching costs: 2.4.49 decoded literal `..` but not %2e%2e [7], and the 2.4.50 fix normalized literal `..` while %2e%2e still bypassed the check, scoring 9.8 against the 7.5 it was meant to close [8][19]. Moving normalization to the edge relocates the mismatch rather than removing it, because the two parsers stay independent [15].
The strong version of the claim, that any HTTP stack with two or more parsers carries an inconsistency window sized by its pair of design decisions [16], is a design argument, not a measurement. The six CVEs are published bypasses in products with different parse pairs, not a census of exposure. The number transfers to a given stack only if the matcher and the router are separate implementations and the matcher evaluates the pre-decode string; where matching happens after decode in the same parser, the window for these four techniques closes [20]. The AWS HTTP API case, where a trailing slash matched the route but reached the Lambda authorizer with `userId` undefined and permitted unauthenticated wire transfers at a fintech, carries no CVE and rests on the dev.to account alone [13]. That leaves REJECT as the honest edge setting: a gateway cannot guarantee agreement with a parser it does not own, but it can refuse to forward a path two parsers would read differently [6][15].
