Resolved

We have identified the root cause of the issue as a recently updated Web Application Firewall (WAF) rule. The impact was confined to POST requests containing multipart/form-data payloads with specific data patterns that triggered the WAF rule.

Given the nature of the rule, the specific data required to activate it, and the low volume of affected requests, this false positive scenario was not detected during our testing phase.

The change has been reverted, and the issue is now fully resolved.