- CVE-2026-93682: out-of-bounds read in the http:// wrapper on an empty Location header (GH-23467); an empty Location allocates only the NUL terminator, so the relative-redirect branch's *(location+1) read ran off the end of the allocation and could append a garbage-derived path to the redirect target instead of the host root. Test the tracked header_info.location_len instead of calling strlen() and instead of reading the second byte. Includes the GH-23521 follow-up, so the relative-join check is location_len > 1 and a one-character Location keeps resolving against the host root as it did before GH-23467