Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
6.1
CVE-2021-23387: Trailing Slash in Package Creates Redirect to Untrusted Sites
CVE-2021-23387 · published 5 years ago
Summary
A security issue in the trailing-slash package allows attackers to redirect users to malicious sites by manipulating URLs. This affects users of the package before version 2.0.1. To fix this, update to version 2.0.1 or later to prevent unauthorized redirects.
What to do
- Update fardog trailing-slash to version 2.0.1.
- Update trailing-slash_project trailing-slash to version 2.0.1 or later.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| npm | fardog | trailing-slash |
< 2.0.1 Fix: upgrade to 2.0.1
|
| – | trailing-slash_project | trailing-slash |
< 2.0.1 cpe:2.3:a:trailing-slash_project:trailing-slash:*:*:*:*:*:node.js:*:* |
Original advisory text
Open Redirect in trailing-slash
The package trailing-slash before 2.0.1 are vulnerable to Open Redirect via the use of trailing double slashes in the URL when accessing the vulnerable endpoint (such as https://example.com//attacker.example/). The vulnerable code is in index.js::createTrailing(), as the web server uses relative URLs instead of absolute URLs.
References
- https://nvd.nist.gov/vuln/detail/CVE-2021-23387
- https://github.com/advisories/GHSA-rfhr-62xp-2fp2
- https://github.com/fardog/trailing-slash/blob/f640ece055fe85275c983de5eb94661b95... Broken Link
- https://github.com/fardog/trailing-slash/commit/f8e66f1429308247e5a119d430203077... Patch Third Party Advisory
- https://snyk.io/vuln/SNYK-JS-TRAILINGSLASH-1085707 Exploit Patch Third Party Advisory
Internet-facing
60 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit (estimated)
- Gives an attacker partial control (estimated)
Severity
6.1
Medium
Type
CWE-601Open Redirect
Timeline
Published24 May 2021
Updated4 Nov 2026
First seen6 Mar 2026
Track software like this
Free during beta