Executive brief
Astro is a web framework used to build fast, content-focused websites. A flaw in how Astro processes URLs with double slashes can trick users into visiting attacker-controlled websites when they click seemingly legitimate links pointing to the site. This can lead to phishing attacks, credential theft, or malware distribution. The vulnerability only affects sites using server-side rendering with Node or Cloudflare adapters; static sites and those deployed to Netlify or Vercel are unaffected.
Technical details
This is an open redirection vulnerability (CWE-601) in the trailing slash normalization logic. When a request path starts with double slashes (e.g., /example.com//), Astro's 301 redirect uses a relative Location header starting with // (protocol-relative URL). Browsers interpret this as a redirect to a different domain: https://example.com//target.domain/subpath becomes Location: //target.domain/subpath/, redirecting to https://target.domain/subpath/. No authentication is required; any unauthenticated user visiting a crafted malicious link can trigger the redirection. The vulnerability affects Astro versions 5.2.0 through 5.12.7 running on-demand rendering (SSR) with Node or Cloudflare adapters. A fix was released in version 5.12.8.
Affected products
- Astro Astro >=5.2.0, <5.12.8
Timeline
- 2025-08-07: disclosed
- 2025-08-08: patched: Fix released in version 5.12.8