Fetching a format!-built URL lets an attacker steer requests to internal hosts.
Validate the URL against an allowlist of hosts and block private/link-local ranges.