CVE-2026-59730

Name of the Vulnerable Software and Affected Versions Astro versions 8.1.0 through 11.0.1

Description When the trailingSlash variable is configured as 'always', the @astrojs/node standalone server's static file handler appends a trailing slash to request paths and issues a 301 redirect. Paths starting with / (slash-backslash) are not recognized as internal paths, causing the handler to echo the raw path in the Location header. Since browsers treat `` as / according to the WHATWG URL specification, this redirect can lead users to an external host. Exploitation requires the trailingSlash variable to be set to 'always', the request path to lack a file extension in its final segment, and the delivery of a crafted link to a user.

Recommendations Update to version 11.0.2. Use the default trailingSlash: 'ignore' setting to prevent the static file handler from issuing trailing-slash redirects.