Open redirect via post-validation URL encoding

Open redirect in Express before 4.19.2 and 5.0.0-alpha.1 through 5.0.0-beta.2 allows remote attackers to redirect users via malformed URLs. The res.location() method encodes the URL after application allowlist validation, allowing backslashes in the authority portion to become percent-encoded and change the host interpreted by clients; res.redirect() calls the same method. Exploitation requires an application to pass attacker-controlled redirect input and a user to follow the resulting redirect, enabling navigation to an attacker-selected site.