{"id":"CVE-2026-59730","aliases":["GHSA-r557-wffq-wvrc"],"title":"@astrojs/node: Backslash-prefixed paths not recognized as internal by trailing-slash redirect","summary":"@astrojs/node: Backslash-prefixed paths not recognized as internal by trailing-slash redirect","severity":"low","cwe":["CWE-601"],"vendor":"astrojs","product":"@astrojs/node","ecosystem":"npm","affected":["@astrojs/node >= 8.1.0, < 11.0.2"],"patched":["@astrojs/node 11.0.2"],"published":"2026-07-20","updated":"2026-07-20","source":"GHSA","sourceUrl":"https://github.com/advisories/GHSA-r557-wffq-wvrc","references":[{"url":"https://github.com/withastro/astro/security/advisories/GHSA-r557-wffq-wvrc"},{"url":"https://github.com/withastro/astro/pull/17252"},{"url":"https://github.com/withastro/astro/commit/eb6f97e391ee587747e37609c255c7cd4b9cce3c"},{"url":"https://github.com/withastro/astro/releases/tag/@astrojs/node@11.0.2"},{"url":"https://github.com/advisories/GHSA-r557-wffq-wvrc"}],"tags":["ghsa","npm"],"ingestedAt":"2026-07-20T23:44:02.313Z","epss":0.0046,"epssPercentile":0.37204,"slug":"CVE-2026-59730","body":"## Overview\n\n### Impact\n\nWith `trailingSlash: 'always'` configured, the `@astrojs/node` standalone server's static file handler appends a trailing slash to request paths and issues a `301` redirect. Paths beginning with `/\\` (slash-backslash) were not recognized as internal paths, so the handler would echo the raw path back in the `Location` header. Because browsers treat `\\` as `/` per the WHATWG URL specification, the resulting redirect could resolve to an external host.\n\n**Preconditions:**\n- `trailingSlash: 'always'` must be set (non-default; the default is `'ignore'`)\n- The request path must not have a file extension in its final segment\n- An attacker must deliver the crafted link to a user\n\n### Patches\n\nFixed by treating backslash-prefixed paths the same as `//`-prefixed paths in `isInternalPath()`, so they are no longer rewritten with a trailing slash.\n\n### Workarounds\n\nUse the default `trailingSlash: 'ignore'` setting, which does not issue trailing-slash redirects in the static file handler.\n\n### References\n\n- [WHATWG URL spec: backslash normalization](https://url.spec.whatwg.org/#url-parsing)\n\n## Affected packages\n\n- `@astrojs/node >= 8.1.0, < 11.0.2`\n\n## Remediation\n\nUpgrade to a patched release:\n\n- `@astrojs/node 11.0.2`","depth":"sunlit","depthScore":14,"depthScoreParts":{"impact":13.8,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}