PT-2025-32332 · Astro · Astro
Ghiyastfarisi
·
Published
2025-08-07
·
Updated
2026-03-25
·
CVE-2025-54793
CVSS v4.0
6.9
Medium
| Vector | AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N |
Name of the Vulnerable Software and Affected Versions
Astro versions 5.2.0 through 5.12.7
Description
Astro is susceptible to an Open Redirect vulnerability stemming from improper handling of paths containing double slashes in its trailing slash redirection logic. This allows an attacker to redirect users to arbitrary external domains via crafted URLs, potentially leading to phishing and social engineering attacks. The vulnerability affects sites utilizing on-demand rendering (SSR) with the Node or Cloudflare adapters, but does not impact static sites or those deployed to Netlify or Vercel. The issue arises because the application uses a relative path for the redirect, and when the target path starts with
//, the browser interprets it as a protocol-relative URL, resulting in redirection to a malicious domain. The URL needed to trigger the vulnerability varies according to the trailingSlash setting.Recommendations
Astro version 5.12.8 resolves this issue.
Upgrade to Astro version 5.12.8.
As a temporary workaround, block outgoing redirect responses with a
Location header value that starts with // at the network level.Exploit
Fix
Open Redirect
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Astro