CVE-2026-66754 affects Rouille versions 0.1.6 through 3.6.2, a Rust web framework. The vulnerability resides in the Request::remove_prefix function, which contains a reachable assertion that can be triggered by remote unauthenticated attackers. By sending a crafted percent-encoded URL where the decoded path matches a configured prefix but the raw encoded path does not, attackers cause the assert! macro to fail. Depending on the panic configuration, this results in either a 500 Internal Server Error or full process termination. This makes it a denial-of-service vulnerability exploitable without any authentication. No special privileges or user interaction are required to exploit this flaw. The issue is caused by inconsistent handling of percent-encoded versus decoded URL paths in prefix matching logic.