CVE-2026-56326: Unchecked Url Pathname Reconstructioncve-2026-56326-unchecked-url-pathname-reconstruction
Reconstructing a relative URL directly from `URL.pathname` without sanitizing leading slashes can lead to Open Redirect vulnerabilities. When parsing user input with a dummy base, inputs like `/.//evil.com` normalize to a pathname of `//evil.com`. If this is used in a navigation or redirect, it is treated as a protocol-relative URL to an external domain. Col
