CVE-2026-59730: Astro Framework SSRF Vulnerability

CVE-2026-59730 Overview

CVE-2026-59730 is an open redirect vulnerability [CWE-601] in the Astro web framework's @astrojs/node standalone server. The flaw affects versions 8.1.0 through 11.0.1 when trailingSlash: 'always' is configured. The static file handler fails to recognize paths beginning with /\ (slash-backslash) as internal, echoing the raw path into the Location header of a 301 redirect. Browsers interpret \ as / per the WHATWG URL specification, so a crafted path like /\attacker.example resolves to an external host. Attackers can abuse this to redirect users to phishing infrastructure. The issue is fixed in @astrojs/node version 11.0.2.

Critical Impact
Attackers can craft links that trigger redirects from a trusted Astro-hosted site to an external attacker-controlled domain, enabling phishing and credential theft.

Affected Products

Astro @astrojs/node standalone server versions 8.1.0 through 11.0.1
Deployments configured with trailingSlash: 'always' (non-default)
Request paths without a file extension in the final segment

Discovery Timeline

2026-07-27 - CVE-2026-59730 published to NVD
2026-07-28 - Last updated in NVD database

Technical Details for CVE-2026-59730

Vulnerability Analysis

The vulnerability lives in the isInternalPath helper in packages/internal-helpers/src/path.ts. When trailingSlash: 'always' is set, the standalone Node server appends a trailing slash to any incoming request path lacking one and returns a 301 redirect. The internal path check inspected only the first two characters of the raw path against a set of internal prefixes such as //. A path starting with /\ did not match, so the handler treated the input as a regular route and reflected it into the Location header.

Browsers implementing the WHATWG URL specification normalize backslashes to forward slashes when parsing the location value. A Location: /\attacker.example/ header therefore resolves to //attacker.example/, a protocol-relative URL, and the browser follows it to the attacker-controlled host.

Root Cause

The root cause is inconsistent path normalization between the framework and the browser. The internal-path prefix comparison operated on raw characters and did not fold \ into / before matching. This is a classic input canonicalization gap producing an open redirect.

Attack Vector

Exploitation requires an attacker to deliver a crafted link to a victim. The target application must run an affected Astro version, use the @astrojs/node standalone adapter, and be configured with trailingSlash: 'always'. The requested path must also lack a file extension in its final segment. When the victim clicks the link, the vulnerable server responds with a 301 redirect whose Location header, once normalized by the browser, points to the attacker's domain.

typescript

// Security patch in packages/internal-helpers/src/path.ts
const JUST_SLASHES = /^\/{2,}$/;

export function isInternalPath(path: string) {
-	return INTERNAL_PREFIXES.has(path.slice(0, 2)) && !JUST_SLASHES.test(path);
+	// Browsers follow the WHATWG URL spec and treat backslashes as forward
+	// slashes when resolving a path, so `/\host` behaves like `//host`. Fold
+	// backslashes to forward slashes before comparing the prefix so those
+	// paths are recognized as internal too, instead of being appended with a
+	// trailing slash and echoed back into a `Location` header.
+	const prefix = path.slice(0, 2).replace(/\\/g, '/');
+	return INTERNAL_PREFIXES.has(prefix) && !JUST_SLASHES.test(path);
}

Source: GitHub commit eb6f97e

Detection Methods for CVE-2026-59730

Indicators of Compromise

HTTP 301 responses from Astro origins containing a Location header that begins with /\ followed by an external hostname.
Access log entries showing request paths starting with /\ (URL-encoded as /%5C) without a file extension in the final segment.
Referrer chains where users leave a trusted Astro-hosted domain immediately after a 301 redirect to an unfamiliar host.

Detection Strategies

Inspect reverse-proxy or CDN logs for outbound Location headers whose value starts with /\ or /%5C and flag them for review.
Deploy a WAF rule that blocks or normalizes request paths containing backslash characters before they reach the Astro node process.
Enumerate Astro deployments and confirm the installed @astrojs/node version is 11.0.2 or later using npm ls @astrojs/node.

Monitoring Recommendations

Alert on spikes of 301 responses from Astro endpoints, especially those correlated with inbound clicks from email or messaging platforms.
Track user-agent and referrer telemetry for redirects to newly registered or low-reputation domains originating from your applications.
Review phishing report queues for lures whose landing URL begins with a trusted Astro-hosted domain and includes %5C in the path.

How to Mitigate CVE-2026-59730

Immediate Actions Required

Upgrade @astrojs/node to version 11.0.2 or later across all affected deployments.
If upgrading is not immediately possible, change trailingSlash from 'always' to the default 'ignore' in astro.config.mjs.
Audit access logs for prior requests containing /\ or /%5C prefixes to identify user exposure.

Patch Information

The fix ships in @astrojs/node 11.0.2 via pull request #17252. Full details are in GitHub Security Advisory GHSA-r557-wffq-wvrc. The patch folds backslashes to forward slashes before comparing the path prefix against the internal prefix set.

Workarounds

Remove the trailingSlash: 'always' setting from the Astro configuration until the package is updated.
Terminate the affected site behind a reverse proxy that rejects or rewrites request paths containing backslash characters.
Add a middleware handler that returns a 400 response for any request whose path contains \ or %5C.

bash

# Upgrade the vulnerable adapter
npm install @astrojs/node@^11.0.2

# Verify the installed version
npm ls @astrojs/node

# Temporary workaround in astro.config.mjs
# export default defineConfig({
#   trailingSlash: 'ignore', // was 'always'
# });