CVE-2026-107718: AdonisJS: Unencoded route parameters can produce open redirects

Route parameters are inserted into generated URLs without URI encoding.

When an application passes untrusted input to a route whose first path segment is dynamic, a value beginning with / can produce a scheme-relative URL. For example:

router.get('/:page', handler).as('pages.show')

response.redirect().toRoute('pages.show', {
page: '/evil.example.com',
})

This generates the following redirect:

Location: //evil.example.com

Browsers interpret this value as an external URL and redirect the user to https://evil.example.com.