Withastro
Monthly
Improper URL construction in the @astrojs/node adapter for the Astro web framework (versions prior to 11.1.3) allows an unauthenticated remote client to terminate or disrupt a Node-hosted Astro site by sending a Host header whose port cannot be parsed, such as example.com:65536, example.com:99999, example.com:-1, example.com:abc, or a duplicated port like example.com:8080:8080. In the default standalone configuration the malformed host triggers an HTTP 500 while the server keeps running, but when the non-default staticHeaders option is enabled the exception is thrown from a synchronous handler, escapes the adapter's error handling, and crashes the Node process, producing a full availability loss. Impact is availability-only with no data exposure and no code execution path; any fronting proxy or CDN that rejects malformed Host headers prevents the request from reaching the origin and neutralizes the attack. No public exploit code or confirmed active exploitation was identified at time of analysis, and the vendor-released fix is @astrojs/node 11.1.3.
Authorization bypass in the Astro web framework version 6.4.7 lets remote unauthenticated attackers reach protected routes by exploiting an inconsistency between how the framework decodes URL paths for auth decisions versus route matching. Because authorization runs against a path that hit the iterative URL-decoder limit while later rewrite matching applies an extra decodeURI(), a request that appears benign at the auth gate resolves to a guarded route afterward, exposing protected content. No public exploit has been identified at time of analysis, but the fix in 6.4.8 and a published GitHub Security Advisory confirm the flaw.
Reflected and stored cross-site scripting can occur in Astro Framework versions prior to 7.3.2 when an application passes attacker-controlled data as a dynamic child of a <script> or <style> element rendered through the astro:jsx renderer, including MDX components. Exploitation is conditional on that developer-introduced pattern-compiler-generated literal script/style content and other JSX expression contexts are not affected-and requires the victim to load the crafted page (UI:R). No public exploit code was identified at time of analysis; the NVD score is 6.5, while our independent assessment treats impact as limited (S:C/C:L/I:L/A:N) because the vulnerable pattern is not a default configuration.
CSS injection in Astro's server-side View Transition generator (versions 7.1.0 through 7.3.2) lets attacker-controlled strings placed into animation properties - duration, delay, easing, direction, fillMode, or animation name - break out of their generated declaration because the ';', '{' and '}' delimiters are serialized unescaped. An application is only affected if it feeds untrusted input into those transition properties; stock Astro sites using hardcoded values are not exploitable. The framework still escapes literal less-than characters, so the injected content cannot close the style element, inject HTML, or execute JavaScript - impact is confined to CSS-level UI manipulation (hiding, repositioning or spoofing content, adding generated text, and conditional resource loads that may leak data already present in selectable DOM attributes). Severity is low (CVSS 4.0 base 2.3; independently assessed as CVSS 3.1 AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N), with no public exploit identified at time of analysis and a vendor fix released in Astro 7.3.3.
Server-side request forgery in the @astrojs/netlify adapter (5.2.0 through 8.2.3) lets unauthenticated remote attackers make the Netlify Image CDN fetch URLs whose host they control, by embedding an allowlisted origin inside the path or query string of a request to the public /.netlify/images endpoint. The impact is limited: Netlify egress protections restrict which internal or external targets are actually reachable and image-transformation handling prevents fetched response bodies from being returned to the attacker, so no confidentiality or integrity impact has been demonstrated and only low availability impact is assessed (CVSS 6.3 per the 4.0 vector; independent assessment CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L). No public exploit code has been identified at time of analysis, and the flaw is fixed in @astrojs/netlify 8.2.4.
Base-path prefix bypass in Astro prior to 7.2.4 allows unauthenticated remote attackers to reach protected server-side routes by exploiting a missing path-segment boundary check in the framework's base-stripping logic. When a non-root base (e.g., '/app') is configured, a request to '/appX/admin' passes the router's prefix check and resolves to the internal '/admin' route while middleware still observes '/appX/admin' in context.url.pathname, causing pathname-based authorization rules to silently fail. Version 7.2.4 patches the flaw across all four affected subsystems; no public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.
Path override bypass in the @astrojs/vercel ISR entrypoint (versions 10.0.3 through 11.0.2) exposes edge-protected routes to unauthenticated remote access via a crafted GET request against the public /_isr function. The root cause is a confused deputy flaw (CWE-441): the origin entrypoint trusts the x-vercel-isr header - which Vercel itself sets on all external requests to /_isr - as sole authorization to accept an attacker-supplied x_astro_path query parameter, silently rewriting the rendered route behind the edge's back. This is a confirmed regression of CVE-2026-33768, reintroduced in 10.0.3 via PR #16079; no public exploit code has been identified, and the fix is confirmed released in @astrojs/vercel 11.0.3.
Regex metacharacter injection in @astrojs/netlify prior to 8.1.2 causes the Netlify Image CDN allowlist to be broader than the developer intended, allowing optimization of images from unintended URL paths on already-allowed hostnames. The root cause is that remotePatternToRegex() escapes dots in hostnames but passes literal pathname values into the generated regex unescaped, so a pathname like /img/v1.0/file silently becomes a wildcard that matches /img/v1X0/file or /img/v1/0/file. No active exploitation has been confirmed (not in CISA KEV), though a working proof-of-concept is included in the GHSA advisory; CVSS 3.7 with AC:H reflects the constrained but network-accessible impact.
Cross-site request forgery in Astro 7.0.0-7.0.5 allows unauthenticated network attackers to trigger state-mutating Actions and on-demand page endpoints using a victim's session cookies when the composable `astro/hono` pipeline is configured with `actions()` or `pages()` mounted without a preceding `middleware()` call. The default non-composable `astro()` pipeline is entirely unaffected; only deployments following the vulnerable pipeline composition pattern - which was demonstrated in the official `examples/advanced-routing` example and Cloudflare Hono documentation - are exposed. The attack is blind write-only: the attacker can mutate server state but cannot read the cross-origin response body. No public exploit or CISA KEV listing exists at time of analysis; the issue is fixed in Astro 7.0.6.
Reflected XSS in Astro's server-side View Transition CSS generator affects all server-rendered or on-demand Astro applications running versions 2.9.0 through 7.0.9. The framework interpolates attacker-controlled animation property values (such as duration, easing, delay, direction, fillMode, and name) directly into an inline <style> element without CSS or HTML escaping, allowing a crafted value containing </style> to break out of the style context and inject arbitrary HTML or JavaScript. A public proof-of-concept exists per the GHSA advisory; no public exploit identified at time of analysis beyond that PoC. The issue is fixed in Astro 7.1.0.
Astro's remotePatterns path enforcement contains a logic flaw where wildcard matching for /* is unanchored, allowing attackers to bypass path restrictions and access unintended resources on allowed hosts. Versions 2.10.10 through 5.18.0 are affected, enabling information disclosure through server-side image optimization endpoints and other remote fetchers. The vulnerability has been patched in version 5.18.1, and while no public exploit code or active exploitation has been reported in KEV databases, the straightforward nature of the bypass makes this a moderate to high priority for affected deployments.
The @astrojs/vercel serverless adapter in Astro versions prior to 10.0.2 contains an unauthenticated path traversal vulnerability that allows attackers to bypass platform-level security restrictions by manipulating the x-astro-path header and x_astro_path query parameter. Any remote attacker without authentication can rewrite internal request paths to access restricted endpoints such as /admin/*, with the attack preserving the original HTTP method and request body, enabling POST, PUT, and DELETE operations against protected resources. The vulnerability has been patched in version 10.0.2, and proof-of-concept code is available via the referenced GitHub security advisory and pull request.
Astro web framework versions prior to 10.0.0 contain an unbounded JSON parsing vulnerability in the Server Islands POST handler that allows unauthenticated remote attackers to exhaust server memory and cause denial of service. The vulnerability affects all Astro SSR applications using the Node standalone adapter, regardless of whether Server Islands functionality is actually used, because the request body is parsed before route validation occurs. An attacker can craft a payload containing many small JSON objects to achieve approximately 15x memory amplification, crashing the process with a single malicious request.
Improper URL construction in the @astrojs/node adapter for the Astro web framework (versions prior to 11.1.3) allows an unauthenticated remote client to terminate or disrupt a Node-hosted Astro site by sending a Host header whose port cannot be parsed, such as example.com:65536, example.com:99999, example.com:-1, example.com:abc, or a duplicated port like example.com:8080:8080. In the default standalone configuration the malformed host triggers an HTTP 500 while the server keeps running, but when the non-default staticHeaders option is enabled the exception is thrown from a synchronous handler, escapes the adapter's error handling, and crashes the Node process, producing a full availability loss. Impact is availability-only with no data exposure and no code execution path; any fronting proxy or CDN that rejects malformed Host headers prevents the request from reaching the origin and neutralizes the attack. No public exploit code or confirmed active exploitation was identified at time of analysis, and the vendor-released fix is @astrojs/node 11.1.3.
Authorization bypass in the Astro web framework version 6.4.7 lets remote unauthenticated attackers reach protected routes by exploiting an inconsistency between how the framework decodes URL paths for auth decisions versus route matching. Because authorization runs against a path that hit the iterative URL-decoder limit while later rewrite matching applies an extra decodeURI(), a request that appears benign at the auth gate resolves to a guarded route afterward, exposing protected content. No public exploit has been identified at time of analysis, but the fix in 6.4.8 and a published GitHub Security Advisory confirm the flaw.
Reflected and stored cross-site scripting can occur in Astro Framework versions prior to 7.3.2 when an application passes attacker-controlled data as a dynamic child of a <script> or <style> element rendered through the astro:jsx renderer, including MDX components. Exploitation is conditional on that developer-introduced pattern-compiler-generated literal script/style content and other JSX expression contexts are not affected-and requires the victim to load the crafted page (UI:R). No public exploit code was identified at time of analysis; the NVD score is 6.5, while our independent assessment treats impact as limited (S:C/C:L/I:L/A:N) because the vulnerable pattern is not a default configuration.
CSS injection in Astro's server-side View Transition generator (versions 7.1.0 through 7.3.2) lets attacker-controlled strings placed into animation properties - duration, delay, easing, direction, fillMode, or animation name - break out of their generated declaration because the ';', '{' and '}' delimiters are serialized unescaped. An application is only affected if it feeds untrusted input into those transition properties; stock Astro sites using hardcoded values are not exploitable. The framework still escapes literal less-than characters, so the injected content cannot close the style element, inject HTML, or execute JavaScript - impact is confined to CSS-level UI manipulation (hiding, repositioning or spoofing content, adding generated text, and conditional resource loads that may leak data already present in selectable DOM attributes). Severity is low (CVSS 4.0 base 2.3; independently assessed as CVSS 3.1 AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N), with no public exploit identified at time of analysis and a vendor fix released in Astro 7.3.3.
Server-side request forgery in the @astrojs/netlify adapter (5.2.0 through 8.2.3) lets unauthenticated remote attackers make the Netlify Image CDN fetch URLs whose host they control, by embedding an allowlisted origin inside the path or query string of a request to the public /.netlify/images endpoint. The impact is limited: Netlify egress protections restrict which internal or external targets are actually reachable and image-transformation handling prevents fetched response bodies from being returned to the attacker, so no confidentiality or integrity impact has been demonstrated and only low availability impact is assessed (CVSS 6.3 per the 4.0 vector; independent assessment CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L). No public exploit code has been identified at time of analysis, and the flaw is fixed in @astrojs/netlify 8.2.4.
Base-path prefix bypass in Astro prior to 7.2.4 allows unauthenticated remote attackers to reach protected server-side routes by exploiting a missing path-segment boundary check in the framework's base-stripping logic. When a non-root base (e.g., '/app') is configured, a request to '/appX/admin' passes the router's prefix check and resolves to the internal '/admin' route while middleware still observes '/appX/admin' in context.url.pathname, causing pathname-based authorization rules to silently fail. Version 7.2.4 patches the flaw across all four affected subsystems; no public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.
Path override bypass in the @astrojs/vercel ISR entrypoint (versions 10.0.3 through 11.0.2) exposes edge-protected routes to unauthenticated remote access via a crafted GET request against the public /_isr function. The root cause is a confused deputy flaw (CWE-441): the origin entrypoint trusts the x-vercel-isr header - which Vercel itself sets on all external requests to /_isr - as sole authorization to accept an attacker-supplied x_astro_path query parameter, silently rewriting the rendered route behind the edge's back. This is a confirmed regression of CVE-2026-33768, reintroduced in 10.0.3 via PR #16079; no public exploit code has been identified, and the fix is confirmed released in @astrojs/vercel 11.0.3.
Regex metacharacter injection in @astrojs/netlify prior to 8.1.2 causes the Netlify Image CDN allowlist to be broader than the developer intended, allowing optimization of images from unintended URL paths on already-allowed hostnames. The root cause is that remotePatternToRegex() escapes dots in hostnames but passes literal pathname values into the generated regex unescaped, so a pathname like /img/v1.0/file silently becomes a wildcard that matches /img/v1X0/file or /img/v1/0/file. No active exploitation has been confirmed (not in CISA KEV), though a working proof-of-concept is included in the GHSA advisory; CVSS 3.7 with AC:H reflects the constrained but network-accessible impact.
Cross-site request forgery in Astro 7.0.0-7.0.5 allows unauthenticated network attackers to trigger state-mutating Actions and on-demand page endpoints using a victim's session cookies when the composable `astro/hono` pipeline is configured with `actions()` or `pages()` mounted without a preceding `middleware()` call. The default non-composable `astro()` pipeline is entirely unaffected; only deployments following the vulnerable pipeline composition pattern - which was demonstrated in the official `examples/advanced-routing` example and Cloudflare Hono documentation - are exposed. The attack is blind write-only: the attacker can mutate server state but cannot read the cross-origin response body. No public exploit or CISA KEV listing exists at time of analysis; the issue is fixed in Astro 7.0.6.
Reflected XSS in Astro's server-side View Transition CSS generator affects all server-rendered or on-demand Astro applications running versions 2.9.0 through 7.0.9. The framework interpolates attacker-controlled animation property values (such as duration, easing, delay, direction, fillMode, and name) directly into an inline <style> element without CSS or HTML escaping, allowing a crafted value containing </style> to break out of the style context and inject arbitrary HTML or JavaScript. A public proof-of-concept exists per the GHSA advisory; no public exploit identified at time of analysis beyond that PoC. The issue is fixed in Astro 7.1.0.
Astro's remotePatterns path enforcement contains a logic flaw where wildcard matching for /* is unanchored, allowing attackers to bypass path restrictions and access unintended resources on allowed hosts. Versions 2.10.10 through 5.18.0 are affected, enabling information disclosure through server-side image optimization endpoints and other remote fetchers. The vulnerability has been patched in version 5.18.1, and while no public exploit code or active exploitation has been reported in KEV databases, the straightforward nature of the bypass makes this a moderate to high priority for affected deployments.
The @astrojs/vercel serverless adapter in Astro versions prior to 10.0.2 contains an unauthenticated path traversal vulnerability that allows attackers to bypass platform-level security restrictions by manipulating the x-astro-path header and x_astro_path query parameter. Any remote attacker without authentication can rewrite internal request paths to access restricted endpoints such as /admin/*, with the attack preserving the original HTTP method and request body, enabling POST, PUT, and DELETE operations against protected resources. The vulnerability has been patched in version 10.0.2, and proof-of-concept code is available via the referenced GitHub security advisory and pull request.
Astro web framework versions prior to 10.0.0 contain an unbounded JSON parsing vulnerability in the Server Islands POST handler that allows unauthenticated remote attackers to exhaust server memory and cause denial of service. The vulnerability affects all Astro SSR applications using the Node standalone adapter, regardless of whether Server Islands functionality is actually used, because the request body is parsed before route validation occurs. An attacker can craft a payload containing many small JSON objects to achieve approximately 15x memory amplification, crashing the process with a single malicious request.