Data::findByRequestUrl can resolve malformed CGI REQUEST_URI with multiple leading slashes to the home page

[dadaxr]

Bug description

Hi,

We found an issue where malformed frontend URLs containing multiple leading slashes after the host can be resolved to the home page instead of returning a 404.
This seems environment-dependent and appears related to how different SAPIs / server integrations expose REQUEST_URI to PHP.
In our local Docker setup, Apache normalizes multiple slashes before PHP receives the request. In production, using Apache with CGI/FastCGI (GATEWAY_INTERFACE=CGI/1.1), PHP receives the original malformed REQUEST_URI.

Example
Normal missing URL:
https://example.com/url-that-does-not-exist
correctly returns a 404.

Malformed missing URL:
https://example.com////url-that-does-not-exist
returns a 200 response with the home page content in the CGI/FastCGI environment.

Environment Difference
Local Apache/PHP receives a normalized URI:

[
 'REQUEST_URI' => '/url-that-does-not-exist',
]

Production CGI/FastCGI receives the original malformed URI:

[
 'REQUEST_URI' => '////url-that-does-not-exist',
 'GATEWAY_INTERFACE' => 'CGI/1.1',
 'REDIRECT_URL' => '/url-that-does-not-exist',
]

How to reproduce

Debugging
In Statamic\Http\Controllers\FrontendController@index, I temporarily dumped the result of:
Data::findByRequestUrl($request->url())
For the normal unknown URL:

[
 'request_url' => 'https://example.com/url-that-does-not-exist',
 'data_found' => false,
 'data_class' => null,
 'data_id' => null,
 'data_uri' => null,
]

For the malformed URL in the CGI/FastCGI environment:

[
 'request_url' => 'https://example.com////url-that-does-not-exist',
 'data_found' => true,
 'data_class' => 'Statamic\Structures\Page',
 'data_id' => 'home',
 'data_uri' => '/',
]

So when PHP receives the original malformed REQUEST_URI, Data::findByRequestUrl() appears to normalize or parse the URL in a way that resolves it to /.

Expected Behavior
Malformed URLs like:
////url-that-does-not-exist
should not resolve to the home entry. They should either:

• resolve to /url-that-does-not-exist, then 404 if missing; or
• be treated as not found.

Actual Behavior
The malformed URL resolves to the home page entry:
Statamic\Structures\Page
id: home
uri: /
and returns 200.

Impact
This can make arbitrary malformed URLs return duplicate home page content with 200 status codes, depending on the server/PHP integration. This may have SEO and operational impact.

Logs

Environment

Environment

Production: Apache + CGI/FastCGI (GATEWAY_INTERFACE=CGI/1.1)

Local: Apache Docker setup where multiple slashes are normalized before PHP

Static caching disabled during reproduction

details : 

Environment
Laravel Version: 12.62.0
PHP Version: 8.4.13
Composer Version: 2.8.12
Environment: local
Debug Mode: ENABLED
Maintenance Mode: OFF
Timezone: UTC
Locale: fr

Cache
Config: NOT CACHED
Events: NOT CACHED
Routes: NOT CACHED
Views: CACHED

Drivers
Broadcasting: log
Cache: file
Database: mariadb
Logs: stack / daily, sentry_logs
Mail: log
Queue: sync
Session: file

Storage
public/storage: NOT LINKED

Sentry
Enabled: MISSING DSN
Environment: local
Laravel SDK Version: 4.26.0
PHP SDK Version: 4.29.0
Release: NOT SET
Sample Rate Errors: 100%
Sample Rate Performance Monitoring: NOT SET
Sample Rate Profiling: NOT SET
Send Default PII: DISABLED

Statamic
Addons: 2
License Key: Set
Sites: 1
Stache Watcher: Enabled (auto)
Static Caching: half
Version: 6.24.0 PRO

Statamic Addons
statamic-rad-pack/runway: 9.5.2
statamic/seo-pro: 7.12.3

Installation

Fresh statamic/statamic site via CLI

Additional details

No response