diff --git a/internal/frontend/server.go b/internal/frontend/server.go
index 901d492..ae96d2e 100644
--- a/internal/frontend/server.go
+++ b/internal/frontend/server.go
@@ -132,6 +132,10 @@
 		vulnHandler   http.Handler = s.errorHandler(s.serveVuln)
 	)
 	if redisClient != nil {
+		// The cache middleware uses the URL string as the key for content served
+		// by the handlers it wraps. Be careful not to wrap the handler it returns
+		// with a handler that rewrites the URL in a way that could cause key
+		// collisions, like http.StripPrefix.
 		detailHandler = middleware.Cache("details", redisClient, detailsTTL, authValues)(detailHandler)
 		searchHandler = middleware.Cache("search", redisClient, searchTTL, authValues)(searchHandler)
 		vulnHandler = middleware.Cache("vuln", redisClient, vulnTTL, authValues)(vulnHandler)
@@ -173,7 +177,7 @@
 	}))
 	handle("/golang.org/x", s.staticPageHandler("subrepo", "Sub-repositories"))
 	handle("/files/", http.StripPrefix("/files", s.fileMux))
-	handle("/vuln/", http.StripPrefix("/vuln", vulnHandler))
+	handle("/vuln/", vulnHandler)
 	handle("/", detailHandler)
 	if s.serveStats {
 		handle("/detail-stats/",
diff --git a/internal/frontend/vulns.go b/internal/frontend/vulns.go
index 144dd6e..3ab57f4 100644
--- a/internal/frontend/vulns.go
+++ b/internal/frontend/vulns.go
@@ -163,7 +163,8 @@
 }
 
 func (s *Server) serveVuln(w http.ResponseWriter, r *http.Request, _ internal.DataSource) error {
-	switch r.URL.Path {
+	path := strings.TrimPrefix(r.URL.Path, "/vuln")
+	switch path {
 	case "/":
 		// Serve a list of most recent entries.
 		vulnListPage, err := newVulnListPage(r.Context(), s.vulnClient)
@@ -184,7 +185,7 @@
 		vulnListPage.basePage = s.newBasePage(r, "Vulnerability Reports")
 		s.servePage(r.Context(), w, "vuln/list", vulnListPage)
 	default: // the path should be "/<ID>", e.g. "/GO-2021-0001".
-		id := r.URL.Path[1:]
+		id := path[1:]
 		if !goVulnIDRegexp.MatchString(id) {
 			if r.URL.Query().Has("q") {
 				return &serverError{status: derrors.ToStatus(derrors.NotFound)}