Redirect check that can be bypassed

After login the app redirects to the next query parameter, only if it starts with "/". An attacker sends victims a login link with ?next=//evil.example/login. What happens?

const next = searchParams.get('next') ?? '/'
if (next.startsWith('/')) {
  redirect(next)
}