The URL host/hostname setter must run the basic URL parser with state override (https://url.spec.whatwg.org/#dom-url-host), which strips ASCII tab/newline from the input and then has the host parser UTF-8 percent-decode before domain-to-ASCII. WTF::URL::setHost instead hands any non-ASCII value straight to uidna_nameToASCII (via appendEncodedHostname in WTF/wtf/URL.cpp), so the tab/newline or the literal %xx is baked into the Punycode A-label and the setter disagrees with the constructor on the same input.

const set  = v => { const u = new URL("http://base/"); u.hostname = v; return u.hostname; };
const ctor = v => new URL(`http://${v}/`).hostname;

set("\tß.de");      // bun: "xn---qfa.de" (A-label decodes to "\tß")   node/ctor: "xn--zca.de"
set("ü\t.de");      // bun: "xn---dha.de"                              node/ctor: "xn--tda.de"
set("ü%41.de");     // bun: "xn--a-goa.de" (literal "%41" in the label) node/ctor: "xn--a-dha.de"
set("%C3%BCü.de");  // bun: "base" (silently dropped)                  node/ctor: "xn--tdaa.de"

set("a\tb.com");    // bun: "ab.com", already correct: the pure-ASCII path
                    // in appendEncodedHostname passes through and the full parser runs

The first two inputs mint hostnames whose A-label decodes to an embedded control character, which no spec-conforming host parser can produce (the forbidden-host-code-point check runs on the already-encoded label and cannot see it), so a filter that validates new URL(x) and then assigns u.hostname = x validates a different host than it uses.

Fix

appendEncodedHostname only diverges from the spec on non-ASCII input: for all-ASCII it appends the value as-is and the full URLParser then does the right thing on reparse. URLDecomposition::setHost/setHostname now strip ASCII tab/newline and UTF-8 percent-encode any non-ASCII code points before calling WTF::URL::setHost, which forces that ASCII passthrough and lets URLParser::parseHostAndPort do the spec's percent-decode + domain-to-ASCII exactly as the constructor does. For all-ASCII values with no tab/newline (the common case) the preprocessor is a no-op.

The upstream appendEncodedHostname itself lives in the prebuilt WebKit, so it is not touched here; the WHATWG setter semantics are owned by URLDecomposition in this repo.

Verification

11 new cases in test/js/web/url/url.test.ts assert setter == constructor for tab/LF/CR + non-ASCII, %xx + non-ASCII, mixed, surrogate-pair code points, the host setter with a port, and a pure tab/newline value. Every expected value matches Node 26. 10 of the 11 fail on the released Bun (the one pass is the pure-ASCII control case); all 25 tests in the file pass with this change.

test/js/node/url/url.test.ts and test/js/web/urlpattern/urlpattern.test.ts (414 tests) pass with the fix.

Relationship to open URLDecomposition PRs

#32826 (host/port split and origin), #33195 (empty-host guard), and #33206 (domainToASCII) touch the same file for adjacent bugs but none of them fixes this one: with each of those applied alone, u.hostname = "\tß.de" still yields "xn---qfa.de". #33206's PR body notes this exact mechanism ("setHost applies IDNA to its raw argument before the parse removes them") but only works around it inside domainToASCII. These changes conflict textually on URLDecomposition.cpp and url.test.ts; whichever lands second gets a small rebase.