Packages / @astrojs/node / Security

LowVulnerabilityGHSA-r557-wffq-wvrcCVE-2026-59730Published 20 Jul 2026

@astrojs/node: Backslash-prefixed paths not recognized as internal by trailing-slash redirect

Affected releases · @astrojs/node

  • 11.x11.0.0 – 11.0.1Fixed in 11.0.2
  • 10.x10.0.0 – 10.1.4No fix on this line yet
  • 9.x9.0.0 – 9.5.5No fix on this line yet
  • 8.x8.1.0 – 8.3.4No fix on this line yet

On 11.x, the newest line:

npm install @astrojs/node@11.0.2
11.x

  1. Affected

    11.0.0 – 11.0.1

    2 releases

  2. Fixed

    11.0.2 – 11.1.9

    12 releases, latest

10.x

  1. Affected

    10.0.0 – 10.1.4

    12 releases

9.x

  1. Affected

    9.0.0 – 9.5.5

    28 releases

8.x

  1. Not affected

    8.0.0

    1 release

  2. Affected

    8.1.0 – 8.3.4

    13 releases

117 stable releases of @astrojs/node, oldest to newest, one row per major.

Is your project affected?

Paste your package.json, or type the range you declare for @astrojs/node. It is read in your browser and sent nowhere.

What happens

Impact

With trailingSlash: 'always' configured, the @astrojs/node standalone server's static file handler appends a trailing slash to request paths and issues a 301 redirect. Paths beginning with /\ (slash-backslash) were not recognized as internal paths, so the handler would echo the raw path back in the Location header. Because browsers treat \ as / per the WHATWG URL specification, the resulting redirect could resolve to an external host.

Preconditions:

  • trailingSlash: 'always' must be set (non-default; the default is 'ignore')

  • The request path must not have a file extension in its final segment

  • An attacker must deliver the crafted link to a user

Patches

Fixed by treating backslash-prefixed paths the same as //-prefixed paths in isInternalPath(), so they are no longer rewritten with a trailing slash.

Workarounds

Use the default trailingSlash: 'ignore' setting, which does not issue trailing-slash redirects in the static file handler.

References