Astros's duplicate trailing slash feature leads to an open redirection security issue

Description

There is an Open Redirection vulnerability in the trailing slash redirection logic when handling paths with double slashes. This allows an attacker to redirect users to arbitrary external domains by crafting URLs such as https://mydomain.com//malicious-site.com/. This increases the risk of phishing and other social engineering attacks.

Recommendation

Update the astro package to the latest compatible version. Followings are version details:

• Affected version(s): >= 5.2.0, < 5.12.8
• Patched version(s): 5.12.8

References

• GHSA-cq8c-xv66-36gw
• CVE-2025-54793
• CWE-601
• CAPEC-310
• OWASP 2021-A1
• OWASP 2021-A6

Related Issues

• Astro Cloudflare adapter has Stored Cross-site Scripting vulnerability in /_image endpoint - CVE-2025-65019
• Astro development server error page is vulnerable to reflected Cross-site Scripting - CVE-2025-64745
• Astro allows unauthorized third-party images in _image endpoint - CVE-2025-55303
• Astro allows unauthorized third-party images in _image endpoint (GHSA-xf8x-j4p2-f749) - CVE-2025-55303

Tags:

npm

astro