Is CVE-2026-59730 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-59730 being exploited in the wild.

How severe is CVE-2026-59730?

Medium severity, with a CVSS score of 4, published 27 July 2026.

Which products and versions are affected?

Astro Node.js Adapter >= 8.1.0, = 8.1.0, < 11.0.2, SEMVER:introduced=8.1.0,fixed=11.0.2.

Is there a fix for CVE-2026-59730?

Yes. @astrojs/node (npm): upgrade to 11.0.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-59730 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-59730?

Check whether you run Astro Node.js Adapter or @astrojs/node (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-59730: withastro Astro open redirect in @astrojs/node server

Q: Is there a fix for CVE-2026-59730?

Yes. @astrojs/node (npm): upgrade to 11.0.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-59730 attacked?

It is attacked over the network, in a software library.

Q: Am I affected by CVE-2026-59730?

Check whether you run Astro Node.js Adapter or @astrojs/node (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-59730 · Severity: medium · CVSS 4 · Published 2026-07-27

Astro is a web framework used for building content-driven websites. A vulnerability in its Node.js server component could allow attackers to redirect users from a legitimate website to a malicious external site. This occurs when the server incorrectly processes specific web addresses, potentially leading to phishing attacks or the theft of user credentials.

Technologies: Astro Node.js Adapter, @astrojs/node (npm). Vendors: Astro, npm.

Quick answers

Is CVE-2026-59730 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-59730 being exploited in the wild.
How severe is CVE-2026-59730?: Medium severity, with a CVSS score of 4, published 27 July 2026.
Which products and versions are affected?: Astro Node.js Adapter >= 8.1.0, < 11.0.2; @astrojs/node (npm) >= 8.1.0, < 11.0.2, SEMVER:introduced=8.1.0,fixed=11.0.2.
Is there a fix for CVE-2026-59730?: Yes. @astrojs/node (npm): upgrade to 11.0.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-59730 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-59730?: Check whether you run Astro Node.js Adapter or @astrojs/node (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

@astrojs/node (npm): upgrade to 11.0.2 or later
```
npm install @astrojs/node@11.0.2
```

Technical details

An open redirect vulnerability (CWE-601) exists in the @astrojs/node standalone server's static file handler. When the 'trailingSlash' configuration is set to 'always', the server fails to correctly identify internal paths that begin with a slash-backslash (/\) sequence. Consequently, the server appends a trailing slash and echoes the malicious path into a 301 redirect's Location header. Since modern browsers normalize backslashes to forward slashes, a path like '/\example.com/foo' is interpreted as a protocol-relative URL pointing to an external domain. Exploitation requires the victim to click a specially crafted link. The issue is resolved in version 11.0.2 by ensuring backslash-prefixed paths are recognized as internal.

Affected products

withastro astro >= 8.1.0, < 11.0.2

Identifiers

CVE-2026-59730
GHSA-r557-wffq-wvrc

Timeline

2026-07-01: patched: Fix merged into main branch
2026-07-02: advisory: Version 11.0.2 released
2026-07-27: disclosed: CVE-2026-59730 published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.