CVE-2026-59730 Details
Description
Astro is a web framework for content-driven websites. In versions 8.1.0 through 11.0.1, when trailingSlash: 'always' is configured, the @astrojs/node standalone server's static file handler appends a trailing slash to request paths and issues a 301 redirect. Paths beginning with /\ (slash-backslash) were not recognized as internal paths, so the handler would echo the raw path back in the Location header. Because browsers treat \ as / per the WHATWG URL specification, the resulting redirect could resolve to an external host. Preconditions for exploitation: trailingSlash: 'always' must be set (non-default; the default is 'ignore'), the request path must not have a file extension in its final segment, and an attacker must deliver the crafted link to a user. This issue has been fixed in version 11.0.2.
A vulnerability exists in the Astro web framework, specifically in the @astrojs/node standalone server, versions 8.1.0 through 11.0.0. When the 'trailingSlash' option is set to 'always', the server's static file handler appends a trailing slash to request paths and issues a 301 redirect. However, paths that begin with a backslash were not recognized as internal, causing the handler to return the raw path in the Location header. This mismanagement can lead to redirects pointing to external hosts, as browsers interpret backslashes as forward slashes. The issue arises under certain conditions: the 'trailingSlash' setting must be altered from its default, the request path must lack a file extension in its final segment, and the crafted link must be delivered to a user.
Users can update to @astrojs/node version 11.0.2, where this vulnerability has been fixed. Instructions for updating can be found in the Astro documentation.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Jul 27, 2026CISA-ADP
Assessed Jul 28, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/withastro/astro/commit/eb6f97e391ee587747e37609c255c7cd4b9cce3c | [email protected] | Source CodeVendor |
| https://github.com/withastro/astro/pull/17252 | [email protected] | Issue TrackingVendor |
| https://github.com/withastro/astro/releases/tag/@astrojs/[email protected] | [email protected] | Release NotesVendor |
| https://github.com/withastro/astro/security/advisories/GHSA-r557-wffq-wvrc | [email protected] | AdvisoryRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-601 | URL Redirection to Untrusted Site ('Open Redirect') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Astro | >= 8.1.0, <= 11.0.1 (semver) |
CPE
Remediation
| |
| Astro Node | >= 8.1.0, <= 11.0.0 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 28, 2026 | CVE Modified | CISA-ADP |
| Jul 27, 2026 | New CVE Received | [email protected] |