CVE-2021-23387

The package trailing-slash before 2.0.1 are vulnerable to Open Redirect via the use of trailing double slashes in the URL when accessing the vulnerable endpoint (such as https://example.com//attacker.example/). The vulnerable code is in index.js::createTrailing(), as the web server uses relative URLs instead of absolute URLs.

• CWE-601

• https://github.com/fardog/trailing-slash/blob/f640ece055fe85275c983de5eb94661b95e35670/index.js%23L36Broken Link
• https://github.com/fardog/trailing-slash/commit/f8e66f1429308247e5a119d430203077d8f05048Patch, Third Party Advisory
• https://snyk.io/vuln/SNYK-JS-TRAILINGSLASH-1085707Exploit, Patch, Third Party Advisory
• https://github.com/fardog/trailing-slash/blob/f640ece055fe85275c983de5eb94661b95e35670/index.js%23L36Broken Link
• https://github.com/fardog/trailing-slash/commit/f8e66f1429308247e5a119d430203077d8f05048Patch, Third Party Advisory
• https://snyk.io/vuln/SNYK-JS-TRAILINGSLASH-1085707Exploit, Patch, Third Party Advisory

Published

May 24, 2021

Last Modified

Jun 17, 2026

Status

Modified

• One Click Account Takeover in GranolaHow a notification link broke out of Electron and led to a one-click account takeover.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2021-23381This affects all versions of package killing. If attacker-co…9.8
• CVE-2021-23382The package postcss before 8.2.13 are vulnerable to Regular …7.5
• CVE-2021-23383The package handlebars before 4.7.7 are vulnerable to Protot…9.8
• CVE-2021-23384The package koa-remove-trailing-slashes before 2.0.2 are vul…5.4
• CVE-2021-23385This affects all versions of package Flask-Security. When us…6.1
• CVE-2021-23386This affects the package dns-packet before 5.2.2. It creates…6.5
• CVE-2021-23388The package forms before 1.2.1, from 1.3.0 and before 1.3.2 …5.3
• CVE-2021-23389The package total.js before 3.4.9 are vulnerable to Arbitrar…9.8
• CVE-2021-2339Vulnerability in the MySQL Server product of Oracle MySQL (c…4.9
• CVE-2021-23390The package total4 before 0.0.43 are vulnerable to Arbitrary…9.8
• CVE-2021-23391This affects all versions of package calipso. It is possible…7.1
• CVE-2021-23392The package locutus before 2.0.15 are vulnerable to Regular …7.5