GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

GHSA-R557-WFFQ-WVRC

Vulnerability from github – Published: 2026-07-20 23:22 – Updated: 2026-08-12 20:37
VLAI
Summary
@astrojs/node: Backslash-prefixed paths not recognized as internal by trailing-slash redirect
Details

Impact

With trailingSlash: 'always' configured, the @astrojs/node standalone server's static file handler appends a trailing slash to request paths and issues a 301 redirect. Paths beginning with /\ (slash-backslash) were not recognized as internal paths, so the handler would echo the raw path back in the Location header. Because browsers treat \ as / per the WHATWG URL specification, the resulting redirect could resolve to an external host.

Preconditions: - trailingSlash: 'always' must be set (non-default; the default is 'ignore') - The request path must not have a file extension in its final segment - An attacker must deliver the crafted link to a user

Patches

Fixed by treating backslash-prefixed paths the same as //-prefixed paths in isInternalPath(), so they are no longer rewritten with a trailing slash.

Workarounds

Use the default trailingSlash: 'ignore' setting, which does not issue trailing-slash redirects in the static file handler.

References

Severity
2.1 (Low)
CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N
Show details on source website
To clipboard 

{
  "affected": [
    {
      "package": {
        "ecosystem": "npm",
        "name": "@astrojs/node"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "8.1.0"
            },
            {
              "fixed": "11.0.2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-59730"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-601"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-07-20T23:22:22Z",
    "nvd_published_at": "2026-07-27T21:17:05Z",
    "severity": "LOW"
  },
  "details": "### Impact\n\nWith `trailingSlash: \u0027always\u0027` configured, the `@astrojs/node` standalone server\u0027s static file handler appends a trailing slash to request paths and issues a `301` redirect. Paths beginning with `/\\` (slash-backslash) were not recognized as internal paths, so the handler would echo the raw path back in the `Location` header. Because browsers treat `\\` as `/` per the WHATWG URL specification, the resulting redirect could resolve to an external host.\n\n**Preconditions:**\n- `trailingSlash: \u0027always\u0027` must be set (non-default; the default is `\u0027ignore\u0027`)\n- The request path must not have a file extension in its final segment\n- An attacker must deliver the crafted link to a user\n\n### Patches\n\nFixed by treating backslash-prefixed paths the same as `//`-prefixed paths in `isInternalPath()`, so they are no longer rewritten with a trailing slash.\n\n### Workarounds\n\nUse the default `trailingSlash: \u0027ignore\u0027` setting, which does not issue trailing-slash redirects in the static file handler.\n\n### References\n\n- [WHATWG URL spec: backslash normalization](https://url.spec.whatwg.org/#url-parsing)",
  "id": "GHSA-r557-wffq-wvrc",
  "modified": "2026-08-12T20:37:34Z",
  "published": "2026-07-20T23:22:22Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/withastro/astro/security/advisories/GHSA-r557-wffq-wvrc"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-59730"
    },
    {
      "type": "WEB",
      "url": "https://github.com/withastro/astro/pull/17252"
    },
    {
      "type": "WEB",
      "url": "https://github.com/withastro/astro/commit/eb6f97e391ee587747e37609c255c7cd4b9cce3c"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/withastro/astro"
    },
    {
      "type": "WEB",
      "url": "https://github.com/withastro/astro/releases/tag/@astrojs/node@11.0.2"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N",
      "type": "CVSS_V4"
    }
  ],
  "summary": "@astrojs/node: Backslash-prefixed paths not recognized as internal by trailing-slash redirect"
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.