Web Framework Vulnerability in Astro Affects Static File Handling

CVE-2026-59730

What is CVE-2026-59730?

Astro, a web framework designed for content-driven websites, has a redirect vulnerability affecting versions 8.1.0 through 11.0.1. When the configuration 'trailingSlash: always' is enabled, the @astrojs/node standalone server improperly handles static file requests by appending a trailing slash to the paths. This misconfiguration leads to echoing raw paths that can inadvertently cause redirects to external hosts. This occurs under specific conditions: the configured paths must lack a file extension in their last segment, and an attacker must successfully entice a user to follow a malicious link. The vulnerability has been addressed in version 11.0.2.

References