CVE-2021-23387

MediumCVSS 6.1/10Last modified Jun 17, 2026

Description

The package trailing-slash before 2.0.1 are vulnerable to Open Redirect via the use of trailing double slashes in the URL when accessing the vulnerable endpoint (such as https://example.com//attacker.example/). The vulnerable code is in index.js::createTrailing(), as the web server uses relative URLs instead of absolute URLs.

Metrics

CVSS 3.1 6.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-601

Affected software

Vendor	Product	Versions
n/a	trailing-slash	>= unspecified, < 2.0.1

References

https://github.com/fardog/trailing-slash/blob/f640ece055fe85275c983de5eb94661b95e35670/index.js%23L36Broken Link
https://github.com/fardog/trailing-slash/commit/f8e66f1429308247e5a119d430203077d8f05048Patch, Third Party Advisory
https://snyk.io/vuln/SNYK-JS-TRAILINGSLASH-1085707Exploit, Patch, Third Party Advisory
https://github.com/fardog/trailing-slash/blob/f640ece055fe85275c983de5eb94661b95e35670/index.js%23L36Broken Link
https://github.com/fardog/trailing-slash/commit/f8e66f1429308247e5a119d430203077d8f05048Patch, Third Party Advisory
https://snyk.io/vuln/SNYK-JS-TRAILINGSLASH-1085707Exploit, Patch, Third Party Advisory

Timeline

Published: May 24, 2021
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-233885.3The package forms before 1.2.1, from 1.3.0 and before 1.3.2 are vulnerable to Regular Expression Denial of Service (ReDoS) via email validat CVE-2021-233899.8The package total.js before 3.4.9 are vulnerable to Arbitrary Code Execution via the U.set() and U.get() functions.CVE-2021-23394.9Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: DDL). Supported versions that are affected are 8.0.25 and prio CVE-2021-233909.8The package total4 before 0.0.43 are vulnerable to Arbitrary Code Execution via the U.set() and U.get() functions.CVE-2021-233917.1This affects all versions of package calipso. It is possible for a malicious module to overwrite files on an arbitrary file system through t CVE-2021-233927.5The package locutus before 2.0.15 are vulnerable to Regular Expression Denial of Service (ReDoS) via the gopher_parsedir function.CVE-2021-233935.4This affects the package Flask-Unchained before 0.9.0. When using the the _validate_redirect_url function, it is possible to bypass URL vali CVE-2021-233949.8The package studio-42/elfinder before 2.1.58 are vulnerable to Remote Code Execution (RCE) via execution of PHP code in a .phar file. NOTE: CVE-2021-233955.3This affects all versions of package nedb. The library could be tricked into adding or modifying properties of Object.prototype using a __pr CVE-2021-233969.8All versions of package lutils are vulnerable to Prototype Pollution via the main (merge) function.CVE-2021-233979.8All versions of package @ianwalter/merge are vulnerable to Prototype Pollution via the main (merge) function. Maintainer suggests using @gen CVE-2021-233986.1All versions of package react-bootstrap-table are vulnerable to Cross-site Scripting (XSS) via the dataFormat parameter. The problem is trig