The current spec requires to produce a validation error if a newline or tab is encountered, and remove them from the input:

This contradicts the behavior observed in Firefox, Chrome and Edge:

const url = new URL("http://www.example.com/")
url.pathname = 'foo\nbar';
url.href

• Node and WHATWG URL: "http://www.example.com/foobar"
• Firefox, Chrome and Edge: "http://www.example.com/foo%0Abar"

const url = new URL("http://www.example.com/")
url.pathname = 'foo\tbar';
url.href

• Node and WHATWG URL: "http://www.example.com/foobar"
• Firefox, Chrome and Edge: "http://www.example.com/foo%09bar"

This issue was originally reported for Node: nodejs/node#23696
Removing these characters prevents the use of file:// urls to represent files with newlines and tabs in their path.