CVE-2026-59730: @astrojs/node: Backslash-prefixed paths not recognized as internal by trailing-slash redirect
(updated )
With trailingSlash: 'always' configured, the @astrojs/node standalone server’s static file handler appends a trailing slash to request paths and issues a 301 redirect. Paths beginning with /\ (slash-backslash) were not recognized as internal paths, so the handler would echo the raw path back in the Location header. Because browsers treat \ as / per the WHATWG URL specification, the resulting redirect could resolve to an external host.
Preconditions:
trailingSlash: 'always'must be set (non-default; the default is'ignore')- The request path must not have a file extension in its final segment
- An attacker must deliver the crafted link to a user
References
- github.com/advisories/GHSA-r557-wffq-wvrc
- github.com/withastro/astro/commit/eb6f97e391ee587747e37609c255c7cd4b9cce3c
- github.com/withastro/astro/pull/17252
- github.com/withastro/astro/releases/tag/@astrojs/node@11.0.2
- github.com/withastro/astro/security/advisories/GHSA-r557-wffq-wvrc
- nvd.nist.gov/vuln/detail/CVE-2026-59730
Code Behaviors & Features
Detect and mitigate CVE-2026-59730 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →