Astros's duplicate trailing slash feature leads to an open redirection security issue

Description

There is an Open Redirection vulnerability in the trailing slash redirection logic when handling paths with double slashes. This allows an attacker to redirect users to arbitrary external domains by crafting URLs such as https://mydomain.com//malicious-site.com/. This increases the risk of phishing and other social engineering attacks.

Recommendation

Update the astro package to the latest compatible version. Followings are version details:

• Affected version(s): >= 5.2.0, < 5.12.8
• Patched version(s): 5.12.8

References

• GHSA-cq8c-xv66-36gw
• CVE-2025-54793
• CWE-601
• CAPEC-310
• OWASP 2021-A1
• OWASP 2021-A6

Related Issues

• jsondiffpatch is vulnerable to Cross-site Scripting (XSS) via HtmlFormatter::nodeBegin - CVE-2025-9910
• Astro allows unauthorized third-party images in _image endpoint - CVE-2025-55303
• Astro allows unauthorized third-party images in _image endpoint (GHSA-xf8x-j4p2-f749) - CVE-2025-55303
• Astro's server source code is exposed to the public if sourcemaps are enabled - CVE-2024-56159

Tags:

npm

astro