CVE-2021-3189 — slashify
MEDIUMCVE-2021-3189 is a medium-severity (CVSS 6.1) Open Redirect vulnerability in slashify. 1 public exploit reference exists, so weaponization risk is real. No vendor fix is recorded yet; mitigation options are listed below.
Open redirect in Slashify
EPSS Exploitation Probability
Probability of exploitation in the next 30 days, from FIRST.org EPSS.
How urgent is this, really
CVE-2021-3189 by exploitation likelihood (EPSS) against impact (CVSS). Outside the shaded patch-first corner.
Where this sits among everything scored
Of 385,738 CVEs with a current EPSS score, this one falls in the < 10% band (highlighted). Counts from FIRST.org, log-scaled.
Real-World Exposure
How broadly this vulnerability is actually deployed: weekly install volume shows current usage, and reverse-dependency count shows how many other packages break if it stays unpatched.
slashifynpmDescription
The package is an Express middleware that normalises routes by stripping any final slash, redirecting, for example, bookings/latest/ to bookings/latest. However, it does not validate the path it redirects to in any way. In particular, if the path starts with two slashes (or two backslashes, or a slash and a backslash, etc.) it may redirect to a different domain.
Consider the example from the docs. Assume we have run it and started a server on localhost:3000, then visiting localhost:3000///github.com/ redirects you to https://github.com.
Recommendation
This vulnerability is currently un-patched in the slashify package so there is no known safe version of this package. Discontinuing use of slashify is recommended.
Affected Packages
| Ecosystem | Package | Vulnerable range | Fix |
|---|---|---|---|
| 📦npm | slashify | all versions | No fix |
Affected Products
slashifygoogleResearch use only. For defensive security, authorized penetration testing, and academic research only. Never execute exploit code against systems without explicit written authorization.
Detection & mitigation playbook
Open-source dependencyDetect
Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for slashify, including transitive dependencies — a direct dependency you never call can still pull in a vulnerable version.
Remediation status
No patched version of slashify has shipped for CVE-2021-3189 yet. Where your build allows, override or pin the dependency away from the vulnerable range, and apply any maintainer-recommended mitigation.
Mitigate without a patch
Stop reflecting attacker-controlled destinations: resolve every redirect target against an allowlist of paths or hosts you own, prefer a server-side key over a full URL in the request, and reject absolute URLs entirely where the flow only ever needs a relative one.
Frequently Asked Questions
Is CVE-2021-3189 in your dependencies?
Find it across npm, including transitive dependencies.