https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-16T09:24:47.695941+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/euvd-2026-20736 EUVD-2026-20736 2026-10-16T09:24:47.756393+00:00 EUVD-2026-20736 https://cve.radiocsirt.org/vuln/fkie_cve-2021-3189 fkie_cve-2021-3189 2026-10-16T09:24:47.756440+00:00

The slashify package 1.0.0 for Node.js allows open-redirect attacks, as demonstrated by a localhost:3000///example.com/ substring.

 https://cve.radiocsirt.org/vuln/ghsa-f4hq-453j-p95f GHSA-f4hq-453j-p95f — Open redirect in Slashify 2026-10-16T09:24:47.756471+00:00

Affected: npm: slashify

The package is an Express middleware that normalises routes by stripping any final slash, redirecting, for example, `bookings/latest/` to `bookings/latest`. However, it does not validate the path it redirects to in any way. In particular, if the path starts with two slashes (or two backslashes, or a slash and a backslash, etc.) it may redirect to a different domain.

Consider the [example from the docs](https://www.npmjs.com/package/slashify#usage). Assume we have run it and started a server on `localhost:3000`, then visiting `localhost:3000///github.com/` redirects you to https://github.com.

## Recommendation

This vulnerability is currently un-patched in the `slashify` package so there is no known safe version of this package. Discontinuing use of `slashify` is recommended.

 https://cve.radiocsirt.org/vuln/gsd-2021-3189 gsd-2021-3189 2026-10-16T09:24:47.756502+00:00 gsd-2021-3189