Link to the code that reproduces this issue

https://github.com/hdodov/test-nextjs/tree/bug-filesystem-routing

To Reproduce

I've put detailed instructions in my reproduction repo's README.

Current vs. Expected behavior

What it boils down to is the normalization of URLs containing "%2e" which decodes to a period ("."). For example, Next will route the following URLs differently:

• http://localhost:3000/api/my-route
• http://localhost:3000/api/test/%2e%2e/my-route

…which I believe is not the correct behavior.

If I have these two routes in my app:

• app/api/my-route/route.ts
• app/api/[...anything]/route.ts

…then the following happens:

1. http://localhost:3000/api/my-route
   • renders app/api/my-route/route.ts
2. http://localhost:3000/api/test/%2e%2e/my-route
   • renders app/api/[...anything]/route.ts

On one hand, it makes sense that the [...anything] route is rendered in the second case, since the URL path doesn't literally match api/my-route. But browsers normalize the URLs and Next.js does so as well, since request.nextUrl.pathname is resolved to /api/my-route in both cases.

So it doesn't make sense that nextUrl.pathname is /api/my-route, but the rendered route is not api/my-route/route.ts. Check the README in my reproduction repo for more details.

Provide environment information

Operating System:
  Platform: darwin
  Arch: arm64
  Version: Darwin Kernel Version 24.6.0: Wed Oct 15 21:12:39 PDT 2025; root:xnu-11417.140.69.703.14~1/RELEASE_ARM64_T8132
  Available memory (MB): 16384
  Available CPU cores: 10
Binaries:
  Node: 22.21.0
  npm: 10.9.4
  Yarn: N/A
  pnpm: 10.19.0
Relevant Packages:
  next: 16.0.6 // Latest available version is detected (16.0.6).
  eslint-config-next: 15.4.4
  react: 19.1.1
  react-dom: 19.1.1
  typescript: 5.9.3
Next.js Config:
  output: N/A

Which area(s) are affected? (Select all that apply)

Dynamic Routes

Which stage(s) are affected? (Select all that apply)

next dev (local)

Additional context

This can also be a security concern, as it opens the door for cache poisoning attacks:

• I configure my proxy (e.g. Cloudflare) to cache /api/my-route
• I make a request to /api/test/%2e%2e/my-route
• Next.js maps this to a completely unexpected route
• That route returns an HTTP 4XX status (or even 5XX)
• The proxy caches the 4XX response
• Regular requests to /api/my-route show the broken cached response