Kong Gateway Enterprise and Kong AI Gateway include decoded Carriage Return (CR) and Line Feed (LF) characters from the request path in the `X-Forwarded-Prefix` header when using regex Routes. This behavior allows for HTTP header injection and request smuggling to the upstream server. Request smuggling is a technique used to interfere with the way a website processes sequences of HTTP requests.