Astros's duplicate trailing slash feature leads to an open redirection security issue

Description

There is an Open Redirection vulnerability in the trailing slash redirection logic when handling paths with double slashes. This allows an attacker to redirect users to arbitrary external domains by crafting URLs such as https://mydomain.com//malicious-site.com/. This increases the risk of phishing and other social engineering attacks.

Recommendation

Update the astro package to the latest compatible version. Followings are version details:

• Affected version(s): >= 5.2.0, < 5.12.8
• Patched version(s): 5.12.8

References

• GHSA-cq8c-xv66-36gw
• CVE-2025-54793
• CWE-601
• CAPEC-310
• OWASP 2021-A1
• OWASP 2021-A6

Related Issues

• @astrojs/node's trailing slash handling causes open redirect issue - CVE-2025-55207
• Astro vulnerable to reflected XSS via the server islands feature - CVE-2025-64764
• Astro's bypass of image proxy domain validation leads to SSRF and potential XSS - CVE-2025-59837
• @octokit/request-error has a Regular Expression in index that Leads to ReDoS Vulnerability Due to Catastrophic Backtrack - CVE-2025-25289

Tags:

npm

astro