N/A

CVSS Score

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2025-55207

CVE-2025-55207: @astrojs/node's trailing slash handling causes open redirect issue

Summary

Following https://github.com/withastro/astro/security/advisories/GHSA-cq8c-xv66-36gw, there's still an Open Redirect vulnerability in a subset of Astro deployment scenarios.

Details

Astro 5.12.8 fixed a case where https://example.com//astro.build/press would redirect to the external origin //astro.build/press. However, with the Node deployment adapter in standalone mode and trailingSlash set to "always" in the Astro configuration, https://example.com//astro.build/press still redirects to //astro.build/press.

Proof of Concept

Create a new minimal Astro project (astro@5.12.8)

Configure it to use the Node adapter (@astrojs/node@9.4.0) and force trailing slashes:

// astro.config.mjs
import { defineConfig } from 'astro/config';
import node from '@astrojs/node';

export default defineConfig({
  trailingSlash: 'always',
  adapter: node({ mode: 'standalone' }),
});

Build the site by running astro build.
Run the server, e.g. with astro preview.
Append //astro.build/press to the preview URL, e.g. http://localhost:4321//astro.build/press
The site will redirect to the external Astro Build origin.

Example reproduction

Open this StackBlitz reproduction.
Open the preview in a separate window so the StackBlitz embed doesn't cause security errors.
Append //astro.build/press to the preview URL, e.g. https://x.local-corp.webcontainer.io//astro.build/press.
See it redirect to the external Astro Build origin.

Impact

This is classified as an Open Redirection vulnerability (CWE-601). It affects any user who clicks on a specially crafted link pointing to the affected domain. Since the domain appears legitimate, victims may be tricked into trusting the redirected page, leading to possible credential theft, malware distribution, or other phishing-related attacks.

No authentication is required to exploit this vulnerability. Any unauthenticated user can trigger the redirect by clicking a malicious link.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2025-55207

CVE-2025-55207:

N/A

CVSS Score

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
@astrojs/node	npm	<= 9.4.0	9.4.1

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability lies in the @astrojs/node package, specifically within the createStaticHandler function in packages/integrations/node/src/serve-static.ts. The function is responsible for handling static file serving and, in certain configurations, enforcing trailing slashes on URLs.

The vulnerability occurs when the trailingSlash option is set to "always". In this case, if a request is made with a URL path that starts with a double slash (e.g., //malicious.com), the server would incorrectly construct a redirect to that external domain. This is a classic open redirect vulnerability (CWE-601).

The fixing commit 5fc3c599cacb0172cc7d8e1202a5f2e8685d7ef2 addresses this by introducing a new check, isInternalPath, before creating the redirect. This function validates that the path is not an external URL, thus closing the vulnerability.

The vulnerable function, createStaticHandler, would be the one to appear in a runtime profile during exploitation, as it contains the logic that processes the malicious input and generates the redirect.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.