EUVD-2026-31683

Hackney has CRLF / header injection via unvalidated domain and path options...