Path normalization is the process a web server uses to decode, clean up, and interpret a URL path before it decides which resource to serve. This can include turning percent-encoded bytes into characters, resolving dot segments such as ../, and collapsing equivalent path forms into one canonical route.
It matters because security tools do not always normalize paths the same way as the origin server. A Web Application Firewall may inspect the raw URL and miss a blocked route if it appears in an encoded or altered form, while the application later decodes it and reaches the sensitive handler. Attackers use this gap to bypass filters, access hidden endpoints, or reach vulnerable code. Defenders reduce risk by making sure proxies, WAFs, and applications apply consistent parsing rules, and by testing encoded and malformed paths during security reviews.