Executive brief
Astro is a web framework used for building content-driven websites. A vulnerability in its Node.js server component could allow attackers to redirect users from a legitimate website to a malicious external site. This occurs when the server incorrectly processes specific web addresses, potentially leading to phishing attacks or the theft of user credentials.
Technical details
An open redirect vulnerability (CWE-601) exists in the @astrojs/node standalone server's static file handler. When the 'trailingSlash' configuration is set to 'always', the server fails to correctly identify internal paths that begin with a slash-backslash (/\) sequence. Consequently, the server appends a trailing slash and echoes the malicious path into a 301 redirect's Location header. Since modern browsers normalize backslashes to forward slashes, a path like '/\example.com/foo' is interpreted as a protocol-relative URL pointing to an external domain. Exploitation requires the victim to click a specially crafted link. The issue is resolved in version 11.0.2 by ensuring backslash-prefixed paths are recognized as internal.
Affected products
- withastro astro >= 8.1.0, < 11.0.2
Timeline
- 2026-07-01: patched: Fix merged into main branch
- 2026-07-02: advisory: Version 11.0.2 released
- 2026-07-27: disclosed: CVE-2026-59730 published