Read the docs
TI-2025-34882 Aliases CVE-2025-55207GHSA-9x9c-ghc5-jhw9

@astrojs/node's trailing slash handling causes open redirect issue

Priority MEDIUM 58CWE-601Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Spoofing
Confidentiality · integrity · availability
None · None · None
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA and GitHub. Impact type from CWE-601.

Summary

Astro is a web framework for content-driven websites. Following CVE-2025-54793 there's still an Open Redirect vulnerability in a subset of Astro deployment scenarios prior to version 9.4.1. Astro 5.12.8 addressed CVE-2025-54793 where https://example.com//astro.build/press would redirect to the external origin //astro.build/press. However, with the Node deployment adapter in standalone mode and trailingSlash set to "always" in the Astro configuration, https://example.com//astro.build/press still redirects to //astro.build/press. This affects any user who clicks on a specially crafted link pointing to the affected domain. Since the domain appears legitimate, victims may be tricked into trusting the redirected page, leading to possible credential theft, malware distribution, or other phishing-related attacks. This issue has been patched in version 9.4.1.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00607 49th percentileScored 2026-11-07
Fix Fixed astro (withastro): 9.4.1@astrojs/node (npm): 9.4.1

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
withastroastrobefore 9.4.19.4.1Patch availableCNA
—@astrojs/node (npm)before 9.4.19.4.1Patch availableGHSA-9x9c-ghc5-jhw9
  • astro Vendorwithastro Affected before 9.4.1 Fixed in 9.4.1 Patch available CNA
  • @astrojs/node (npm) Vendor— Affected before 9.4.1 Fixed in 9.4.1 Patch available GHSA-9x9c-ghc5-jhw9

Remediation

  • Fix · CNA astro (withastro) Fixed in 9.4.1
  • Fix · GHSA-9x9c-ghc5-jhw9 @astrojs/node (npm) Fixed in 9.4.1 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2025-55207
  2. 2026-10-03 Alias added: GHSA-9x9c-ghc5-jhw9

References

Advisory 1

Other 3

  • TI-2026-26147 Astro: Unauthenticated Path Override via `x-astro-path` / `x_astro_path` CVSS 3.1CRITICAL 9.1
  • TI-2026-42600 Astro 6.4.7 Authorization Bypass via Decode Iteration Limit and Rewrite Path Canonicalization Mismatch CVSS 3.1HIGH 8.2
  • TI-2024-37142 Server source code is exposed to the public if sourcemaps are enabled CVSS 4.0HIGH 7.8
  • TI-2025-35987 Astro Cloudflare adapter is vulnerable to Server-Side Request Forgery via /_image endpoint CVSS 3.1HIGH 7.2
  • TI-2025-34958 Unauthorized third-party images in Astro’s _image endpoint CVSS 4.0MEDIUM 6.9
  • TI-2026-51542 Astro: Unauthenticated path override in the @astrojs/vercel ISR function CVSS 3.1MEDIUM 6.5
See all 43 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences