Hamdaanaliquatil

HTTP/2 request setup fails to consistently apply proxy settings and caller-supplied DNS lookup policies. When an HTTPS request is configured with `httpVersion: 2` and uses `config.proxy` or environment-derived proxy settings, or relies on a `config.lookup` DNS policy, the HTTP/2 path may connect without applying these configurations before calling `http2.connect()`. This allows requests to bypass the intended proxy route or the specified DNS resolution policy.

Internal URL cache keys are constructed by concatenating the destination and source paths without a delimiter. This allows different destination and source pairs to generate identical keys despite resolving to different upstream URLs. Consequently, when `getUpstream()` selects an upstream from request data, a cached URL for one upstream may be reused for a request intended for another, leading to cross-upstream data access and modification. Real-world incidents of elevated activity targeting this issue have been observed.

A Denial of Service issue exists when using diskStorage. Aborted or malformed multipart uploads leave orphaned partial files on disk because the `Readable.pipe()` call does not propagate the stream destroy signal to the underlying `fs.WriteStream`. This allows an attacker to exhaust disk space by triggering numerous aborted uploads.