CVE-2025-55207: Open Redirect Vulnerability in @astrojs/node Package
Summary
CVE-2025-55207: @astrojs/node's trailing slash handling causes open redirect issue. Affects @astrojs/node versions < 9.4.1. Fixed in 9.4.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The @astrojs/node package is an adapter for the Astro framework, enabling Node.js deployment for Astro applications. It allows developers to build and serve static sites efficiently. However, certain configurations in this package can lead to security vulnerabilities, specifically an open redirect issue that can be exploited by malicious actors.
Vulnerability Detail
The vulnerability arises from improper handling of trailing slashes in URLs when using the Node deployment adapter in standalone mode with the 'trailingSlash' option set to 'always'. This misconfiguration allows attackers to craft URLs that redirect users to external sites, potentially leading to phishing attacks or credential theft. The issue was identified in version 9.4.0 and affects users who click on specially crafted links.
How To Fix
Latest published version: 11.1.9 as of 23 Oct 2026
npm install @astrojs/node@11.1.9Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
9.4.1
This is the first release that contains the fix.
npm install @astrojs/node@9.4.1Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can avoid using the 'trailingSlash' option set to 'always' in your Astro configuration. Modify your astro.config.mjs file as follows:
// astro.config.mjs
import { defineConfig } from 'astro/config';
import node from '@astrojs/node';
export default defineConfig({
trailingSlash: 'never',
adapter: node({ mode: 'standalone' }),
});
Conclusion
The open redirect vulnerability in the @astrojs/node package poses a significant risk to users by allowing malicious redirects. It is crucial to update to the patched version or implement the recommended workaround to mitigate this risk.
See every vulnerability recorded for @astrojs/node →
FAQ
An open redirect vulnerability allows an attacker to redirect users to an external site without their consent, often leading to phishing attacks.
You can check if your application is affected by using Vulert, which monitors and alerts for open-source vulnerabilities in real-time. Visit Vulert Scanner to test your application without any signup.
No, the vulnerability can be exploited by any unauthenticated user simply by clicking on a malicious link.
The potential impacts include credential theft, malware distribution, and other phishing-related attacks, as users may be misled into trusting the redirected page.
If you cannot update the package immediately, consider implementing the suggested workaround by changing the trailingSlash option in your configuration.
References
Related vulnerabilities
Recent vulnerabilities recorded for @astrojs/node.
