CVE-2025-55207: Astro Node adapter open redirect via trailing slash handling

CVE-2025-55207 · Severity: medium · CVSS 4 · Published 2025-08-15

The Astro Node deployment adapter is vulnerable to open redirect attacks when configured with trailingSlash set to "always". An attacker can craft a malicious link with a double slash (e.g., //astro.build/press) that tricks the vulnerable server into redirecting users to an external website, enabling phishing, credential theft, or malware distribution attacks. No authentication is required to exploit this vulnerability.

Technologies: @astrojs/node (npm). Vendors: Astro, npm.

Quick answers

Is CVE-2025-55207 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2025-55207 being exploited in the wild.
How severe is CVE-2025-55207?
Medium severity, with a CVSS score of 4, published 15 August 2025.
Which products and versions are affected?
Astro Node adapter <= 9.4.0; @astrojs/node (npm) SEMVER:introduced=0,fixed=9.4.1.
Is there a fix for CVE-2025-55207?
Yes. @astrojs/node (npm): upgrade to 9.4.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2025-55207 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2025-55207?
Check whether you run Astro Node adapter or @astrojs/node (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • @astrojs/node (npm): upgrade to 9.4.1 or later
    npm install @astrojs/node@9.4.1

Technical details

This is an open redirect vulnerability (CWE-601) in the @astrojs/node adapter's trailing slash normalization logic. When the adapter is configured in standalone mode with trailingSlash set to "always", URLs with protocol-relative paths (double slashes, e.g., //example.com/path) are not properly sanitized before being used in redirect responses. An unauthenticated attacker can exploit this via network access by crafting a specially formatted URL (https://victim.com//attacker.com/path) that the server incorrectly normalizes and redirects to the attacker's domain. The vulnerability affects @astrojs/node versions up to 9.4.0 and is fixed in version 9.4.1.

Affected products

  • Astro Node adapter <= 9.4.0

Identifiers

  • CVE-2025-55207
  • GHSA-9x9c-ghc5-jhw9

Timeline

  • 2025-08-15: disclosed
  • 2025-08-15: patched: Fixed in @astrojs/node 9.4.1

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.