Astros's duplicate trailing slash feature leads to an open redirection security issue

Description

There is an Open Redirection vulnerability in the trailing slash redirection logic when handling paths with double slashes. This allows an attacker to redirect users to arbitrary external domains by crafting URLs such as https://mydomain.com//malicious-site.com/. This increases the risk of phishing and other social engineering attacks.

Recommendation

Update the astro package to the latest compatible version. Followings are version details:

• Affected version(s): >= 5.2.0, < 5.12.8
• Patched version(s): 5.12.8

References

• GHSA-cq8c-xv66-36gw
• CVE-2025-54793
• CWE-601
• CAPEC-310
• OWASP 2021-A1
• OWASP 2021-A6

Related Issues

• @astrojs/node's trailing slash handling causes open redirect issue - CVE-2025-55207
• Astro vulnerable to reflected XSS via the server islands feature - CVE-2025-64764
• Astro's bypass of image proxy domain validation leads to SSRF and potential XSS - CVE-2025-59837
• Astro development server error page is vulnerable to reflected Cross-site Scripting - CVE-2025-64745

You might also like:

CSRF, XXE, and 12 Other Security Acronyms Explained

How to Secure your NodeJs Express Javascript Application - part 2

10 Secure Coding Best Practices to Follow in Every Project

Tags:

npm

astro