CVE-2026-59730: 
JavaScript vulnerability analysis and mitigation

CVE-2026-59730 is an open redirect vulnerability in the @astrojs/node npm package affecting the Astro web framework's standalone Node.js server adapter. When trailingSlash: 'always' is configured, the static file handler fails to recognize paths beginning with /\ (slash-backslash) as internal paths, causing it to echo the raw path back in a 301 redirect Location header. Because browsers normalize \ to / per the WHATWG URL specification, this redirect can resolve to an attacker-controlled external host. Affected versions are >= 8.1.0, < 11.0.2; the patched version is 11.0.2. The vulnerability carries a CVSS v4.0 base score of 2.1 (Low) (GitHub Advisory, Astro Security Advisory).

The root cause is classified as CWE-601 (URL Redirection to Untrusted Site / 'Open Redirect'). The isInternalPath() function in @astrojs/internal-helpers checked only a fixed set of internal prefixes (/_, /@, /., //) against the first two characters of the request path, but did not account for the /\ prefix. When a request path such as /\example.com/press (without a file extension) was received, the handler appended a trailing slash and issued a 301 redirect with the raw path in the Location header. The fix normalizes backslashes to forward slashes in the two-character prefix before comparison, so /\host is now treated identically to //host and falls through to a 404 rather than being redirected (GitHub Advisory, Fix Commit). Exploitation requires the non-default trailingSlash: 'always' configuration, a request path without a file extension in its final segment, and user interaction (the victim must follow a crafted link) (Astro Security Advisory).

Successful exploitation enables an attacker to redirect users from a trusted Astro-hosted site to an arbitrary external host, facilitating phishing, credential harvesting, or malware distribution. There is no direct impact on the confidentiality, integrity, or availability of the vulnerable server itself; the primary risk is to end users who follow attacker-crafted links. The vulnerability's impact is limited to subsequent system integrity (rated Low in CVSS v4.0), with no lateral movement or data exposure on the server side (GitHub Advisory).

1. Identify target: Locate a publicly accessible Astro site running @astrojs/node versions 8.1.0–11.0.1 in standalone mode with trailingSlash: 'always' configured.
2. Craft malicious URL: Construct a URL targeting a path without a file extension that begins with /\ followed by an attacker-controlled domain, e.g., https://victim-site.com/\attacker.com/phishing-page.
3. Bypass URL normalization: Deliver the link in a context where the raw path is preserved (e.g., via email, chat, or a document), since standard browser URL bars and many HTTP clients normalize \ to / before sending. The raw request must reach the server with the backslash intact (similar to curl --path-as-is).
4. Trigger redirect: When the victim clicks the link, the server's static file handler does not recognize /\attacker.com/phishing-page as an internal path, appends a trailing slash, and issues a 301 redirect with Location: /\attacker.com/phishing-page/.
5. Browser resolves external host: The victim's browser interprets \ as /, resolving the Location header as //attacker.com/phishing-page/ and navigating to the attacker's external site (GitHub Advisory, Fix Commit).

• Network: HTTP requests to the Astro server with a raw request-target beginning with /\ (e.g., GET /\example.com/page HTTP/1.1); these would typically only appear in raw socket-level logs since most HTTP clients normalize the path before sending.
• Logs: Server access logs showing 301 responses to paths matching the pattern /\<hostname>/... with a corresponding Location header echoing the backslash path; absence of a matching static file or route for the requested path.
• Network: Outbound 301 redirect responses pointing to unexpected external domains in the Location header, particularly those containing \ characters.

Upgrade @astrojs/node to version 11.0.2 or later, which fixes the isInternalPath() function to treat backslash-prefixed paths as internal (Release Notes). As an immediate workaround, revert to the default trailingSlash: 'ignore' setting in your Astro configuration, which prevents the static file handler from issuing trailing-slash redirects entirely (Astro Security Advisory). The fix was merged on July 2, 2026, and the advisory was published on July 15, 2026.

The vulnerability was reported by security researcher alanturing881 and patched by Astro maintainer matthewp, with the fix reviewed and approved by ematipico before merging (Astro PR #17252). No significant broader media coverage or notable community commentary beyond the official advisory and pull request discussion has been identified.