CVE-2026-59730: Astro is a web framework for content-driven websites. In versions 8.1.0 through 11.0.1, when trailingSlash: 'always' is configured, the @astrojs/node standalone server's static fil

unknownCVE-2026-59730

Astro is a web framework for content-driven websites. In versions 8.1.0 through 11.0.1, when trailingSlash: 'always' is configured, the @astrojs/node standalone server's static file handler appends a trailing slash to request paths and issues a 301 redirect. Paths beginning with /\ (slash-backslash) were not recognized as internal paths, so the handler would echo the raw path back in the Location header. Because browsers treat \ as / per the WHATWG URL specification, the resulting redirect could resolve to an external host. Preconditions for exploitation: trailingSlash: 'always' must be set (non-default; the default is 'ignore'), the request path must not have a file extension in its final segment, and an attacker must deliver the crafted link to a user. This issue has been fixed in version 11.0.2.

Details

Source: NVD Recent CVEs (US · database · site)
Severity: unknown
Published: 2026-07-27
Last updated: 2026-07-28
Exploitation: Not in CISA KEV at last sync

Original advisory: https://nvd.nist.gov/vuln/detail/CVE-2026-59730

Exploitation outlook

EPSS (FIRST.org) estimates each CVE’s probability of exploitation in the next 30 days — here is the CSIRTS.com read on those numbers.

Low exploitation riskCVE-2026-597300.36% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 29% of all scored CVEs.

Referenced CVEs

CVE	CSIRTS overview	External
CVE-2026-59730	coverage & exploitation status	NVD · CVE.org

Same CVEs, other sources

How other CERTs, PSIRTs and databases cover the vulnerabilities in this advisory.

lowGHSA-r557-wffq-wvrc: @astrojs/node: Backslash-prefixed paths not recognized as internal by trailing-slash redi…ghsa

Recent advisories for Astro is a

A cluster of recent advisories against the same product widens the attack surface — attackers routinely chain freshly published CVEs on one product, so review these together.

mediumCVE-2026-59728: Astro is a web framework for content-driven websites. In versions 1.0.0 through 4.0.18, the so…nvd · 2026-07-27
unknownCVE-2026-59729: Astro is a web framework for content-driven websites. Versions prior to 7.0.6 are vulnerable t…nvd · 2026-07-27
unknownCVE-2026-59727: Astro is a web framework for content-driven websites. In versions 3.10.0 through 7.0.3, when a…nvd · 2026-07-27
mediumGHSA-8mv7-9c27-98vc: Astro: composable `astro/hono` pipeline bypasses `security.checkOrigin` when `middleware(…ghsa · 2026-07-20
mediumGHSA-f48w-9m4c-m7f5: Astro: XSS via unescaped spread attribute names in renderHTMLElement (incomplete fix for …ghsa · 2026-07-20
lowGHSA-7pw4-f3q4-r2p2: Astro: Cross-site scripting via unescaped transition:* directive values on hydrated islan…ghsa · 2026-07-20