Deploy autonomous AI agents that reason, exploit, and validate complex vulnerability chains — not another scanner, an agentic system that thinks like a senior pentester.
CVE-2025-54793 is a medium severity vulnerability with a CVSS score of 6.1. Exploits are available; patches have been released and should be applied urgently.
Lower probability of exploitation
EPSS predicts the probability of exploitation in the next 30 days based on real-world threat data, complementing CVSS severity scores with actual risk assessment.
There is an Open Redirection vulnerability in the trailing slash redirection logic when handling paths with double slashes. This allows an attacker to redirect users to arbitrary external domains by crafting URLs such as https://mydomain.com//malicious-site.com/. This increases the risk of phishing and other social engineering attacks.
This affects Astro >=5.2.0 sites that use on-demand rendering (SSR) with the Node or Cloudflare adapter. It does not affect static sites, or sites deployed to Netlify or Vercel.
Astro performs automatic redirection to the canonical URL, either adding or removing trailing slashes according to the value of the trailingSlash configuration option. It follows the following rules:
trailingSlash is set to "never", https://example.com/page/ will redirect to https://example.com/pagetrailingSlash is set to "always", https://example.com/page will redirect to https://example.com/page/It also collapses multiple trailing slashes, according to the following rules:
trailingSlash is set to "always" or "ignore" (the default), https://example.com/page// will redirect to https://example.com/page/trailingSlash is set to "never", https://example.com/page// will redirect to https://example.com/pageIt does this by returning a 301 redirect to the target path. The vulnerability occurs because it uses a relative path for the redirect. To redirect from https://example.com/page to https://example.com/page/, it sending a 301 response with the header Location: /page/. The browser resolves this URL relative to the original page URL and redirects to https://example.com/page/
| Vendor | Product |
|---|---|
| Astro | Astro |
Please cite this page when referencing data from Strobes VI. Proper attribution helps support our vulnerability intelligence research.
The vulnerability occurs if the target path starts with //. A request for https://example.com//page will send the header Location: //page/. The browser interprets this as a protocol-relative URL, so instead of redirecting to https://example.com//page/, it will attempt to redirect to https://page/. This is unlikely to resolve, but by crafting a URL in the form https://example.com//target.domain/subpath, it will send the header Location: //target.domain/subpath/, which the browser translates as a redirect to https://target.domain/subpath/. The subpath part is required because otherwise Astro will interpret /target.domain as a file download, which skips trailing slash handling.
This leads to an Open Redirect vulnerability.
The URL needed to trigger the vulnerability varies according to the trailingSlash setting.
trailingSlash is set to "never", a URL in the form https://example.com//target.domain/subpath/trailingSlash is set to "always", a URL in the form https://example.com//target.domain/subpathhttps://example.com//target.domain/subpath//This is classified as an Open Redirection vulnerability (CWE-601). It affects any user who clicks on a specially crafted link pointing to the affected domain. Since the domain appears legitimate, victims may be tricked into trusting the redirected page, leading to possible credential theft, malware distribution, or other phishing-related attacks.
No authentication is required to exploit this vulnerability. Any unauthenticated user can trigger the redirect by clicking a malicious link.
Usrs can test if your site is affected by visiting https://yoursite.com//docs.astro.build/en//. If a user is redirected to the Astro docs then their site is affected and must be updated.
Upgrade to Astro 5.12.8. To mitigate at the network level, block outgoing redirect responses with a Location header value that starts with //.