The @astrojs/node standalone server in Astro versions 8.1.0 through 11.0.1 performs a trailing‑slash redirect when the configuration option trailingSlash is set to "always". Paths beginning with a backslash are not recognized as internal locations and the handler echoes the raw path into the Location header of a 301 response. Because browsers treat a backslash as a forward slash per the WHATWG URL specification, the redirect could resolve to an external host. Pre‑conditions for exploitation include trailingSlash set to "always", the request path lacking a file extension in its final segment, and an attacker delivering a crafted link to a user. This issue represents an open redirect flaw (CWE‑601).

Astro, the content‑driven web framework hosted by withastro:astro, is affected. The vulnerability applies to @astrojs/node versions 8.1.0 through 11.0.1. Updating to version 11.0.2 or later resolves the issue.

The CVSS score of 2.1 indicates low severity, and an EPSS score of < 1% suggests minimal exploitation pressure. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires that trailingSlash be set to "always", that the request target lack a file extension in its final segment, and that the attacker supply a crafted link to an end‑user. Attack would proceed via a user clicking a link or following a redirect, potentially leading to a malicious site. The likelihood of successful exploitation is low but the risk of social‑engineering attacks remains.