Withastro
Monthly
Authorization bypass in the Astro web framework version 6.4.7 lets remote unauthenticated attackers reach protected routes by exploiting an inconsistency between how the framework decodes URL paths for auth decisions versus route matching. Because authorization runs against a path that hit the iterative URL-decoder limit while later rewrite matching applies an extra decodeURI(), a request that appears benign at the auth gate resolves to a guarded route afterward, exposing protected content. No public exploit has been identified at time of analysis, but the fix in 6.4.8 and a published GitHub Security Advisory confirm the flaw.
Base-path prefix bypass in Astro prior to 7.2.4 allows unauthenticated remote attackers to reach protected server-side routes by exploiting a missing path-segment boundary check in the framework's base-stripping logic. When a non-root base (e.g., '/app') is configured, a request to '/appX/admin' passes the router's prefix check and resolves to the internal '/admin' route while middleware still observes '/appX/admin' in context.url.pathname, causing pathname-based authorization rules to silently fail. Version 7.2.4 patches the flaw across all four affected subsystems; no public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.
Path override bypass in the @astrojs/vercel ISR entrypoint (versions 10.0.3 through 11.0.2) exposes edge-protected routes to unauthenticated remote access via a crafted GET request against the public /_isr function. The root cause is a confused deputy flaw (CWE-441): the origin entrypoint trusts the x-vercel-isr header - which Vercel itself sets on all external requests to /_isr - as sole authorization to accept an attacker-supplied x_astro_path query parameter, silently rewriting the rendered route behind the edge's back. This is a confirmed regression of CVE-2026-33768, reintroduced in 10.0.3 via PR #16079; no public exploit code has been identified, and the fix is confirmed released in @astrojs/vercel 11.0.3.
Regex metacharacter injection in @astrojs/netlify prior to 8.1.2 causes the Netlify Image CDN allowlist to be broader than the developer intended, allowing optimization of images from unintended URL paths on already-allowed hostnames. The root cause is that remotePatternToRegex() escapes dots in hostnames but passes literal pathname values into the generated regex unescaped, so a pathname like /img/v1.0/file silently becomes a wildcard that matches /img/v1X0/file or /img/v1/0/file. No active exploitation has been confirmed (not in CISA KEV), though a working proof-of-concept is included in the GHSA advisory; CVSS 3.7 with AC:H reflects the constrained but network-accessible impact.
Cross-site request forgery in Astro 7.0.0-7.0.5 allows unauthenticated network attackers to trigger state-mutating Actions and on-demand page endpoints using a victim's session cookies when the composable `astro/hono` pipeline is configured with `actions()` or `pages()` mounted without a preceding `middleware()` call. The default non-composable `astro()` pipeline is entirely unaffected; only deployments following the vulnerable pipeline composition pattern - which was demonstrated in the official `examples/advanced-routing` example and Cloudflare Hono documentation - are exposed. The attack is blind write-only: the attacker can mutate server state but cannot read the cross-origin response body. No public exploit or CISA KEV listing exists at time of analysis; the issue is fixed in Astro 7.0.6.
Reflected XSS in Astro's server-side View Transition CSS generator affects all server-rendered or on-demand Astro applications running versions 2.9.0 through 7.0.9. The framework interpolates attacker-controlled animation property values (such as duration, easing, delay, direction, fillMode, and name) directly into an inline <style> element without CSS or HTML escaping, allowing a crafted value containing </style> to break out of the style context and inject arbitrary HTML or JavaScript. A public proof-of-concept exists per the GHSA advisory; no public exploit identified at time of analysis beyond that PoC. The issue is fixed in Astro 7.1.0.
Astro's remotePatterns path enforcement contains a logic flaw where wildcard matching for /* is unanchored, allowing attackers to bypass path restrictions and access unintended resources on allowed hosts. Versions 2.10.10 through 5.18.0 are affected, enabling information disclosure through server-side image optimization endpoints and other remote fetchers. The vulnerability has been patched in version 5.18.1, and while no public exploit code or active exploitation has been reported in KEV databases, the straightforward nature of the bypass makes this a moderate to high priority for affected deployments.
The @astrojs/vercel serverless adapter in Astro versions prior to 10.0.2 contains an unauthenticated path traversal vulnerability that allows attackers to bypass platform-level security restrictions by manipulating the x-astro-path header and x_astro_path query parameter. Any remote attacker without authentication can rewrite internal request paths to access restricted endpoints such as /admin/*, with the attack preserving the original HTTP method and request body, enabling POST, PUT, and DELETE operations against protected resources. The vulnerability has been patched in version 10.0.2, and proof-of-concept code is available via the referenced GitHub security advisory and pull request.
Astro web framework versions prior to 10.0.0 contain an unbounded JSON parsing vulnerability in the Server Islands POST handler that allows unauthenticated remote attackers to exhaust server memory and cause denial of service. The vulnerability affects all Astro SSR applications using the Node standalone adapter, regardless of whether Server Islands functionality is actually used, because the request body is parsed before route validation occurs. An attacker can craft a payload containing many small JSON objects to achieve approximately 15x memory amplification, crashing the process with a single malicious request.
Authorization bypass in the Astro web framework version 6.4.7 lets remote unauthenticated attackers reach protected routes by exploiting an inconsistency between how the framework decodes URL paths for auth decisions versus route matching. Because authorization runs against a path that hit the iterative URL-decoder limit while later rewrite matching applies an extra decodeURI(), a request that appears benign at the auth gate resolves to a guarded route afterward, exposing protected content. No public exploit has been identified at time of analysis, but the fix in 6.4.8 and a published GitHub Security Advisory confirm the flaw.
Base-path prefix bypass in Astro prior to 7.2.4 allows unauthenticated remote attackers to reach protected server-side routes by exploiting a missing path-segment boundary check in the framework's base-stripping logic. When a non-root base (e.g., '/app') is configured, a request to '/appX/admin' passes the router's prefix check and resolves to the internal '/admin' route while middleware still observes '/appX/admin' in context.url.pathname, causing pathname-based authorization rules to silently fail. Version 7.2.4 patches the flaw across all four affected subsystems; no public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.
Path override bypass in the @astrojs/vercel ISR entrypoint (versions 10.0.3 through 11.0.2) exposes edge-protected routes to unauthenticated remote access via a crafted GET request against the public /_isr function. The root cause is a confused deputy flaw (CWE-441): the origin entrypoint trusts the x-vercel-isr header - which Vercel itself sets on all external requests to /_isr - as sole authorization to accept an attacker-supplied x_astro_path query parameter, silently rewriting the rendered route behind the edge's back. This is a confirmed regression of CVE-2026-33768, reintroduced in 10.0.3 via PR #16079; no public exploit code has been identified, and the fix is confirmed released in @astrojs/vercel 11.0.3.
Regex metacharacter injection in @astrojs/netlify prior to 8.1.2 causes the Netlify Image CDN allowlist to be broader than the developer intended, allowing optimization of images from unintended URL paths on already-allowed hostnames. The root cause is that remotePatternToRegex() escapes dots in hostnames but passes literal pathname values into the generated regex unescaped, so a pathname like /img/v1.0/file silently becomes a wildcard that matches /img/v1X0/file or /img/v1/0/file. No active exploitation has been confirmed (not in CISA KEV), though a working proof-of-concept is included in the GHSA advisory; CVSS 3.7 with AC:H reflects the constrained but network-accessible impact.
Cross-site request forgery in Astro 7.0.0-7.0.5 allows unauthenticated network attackers to trigger state-mutating Actions and on-demand page endpoints using a victim's session cookies when the composable `astro/hono` pipeline is configured with `actions()` or `pages()` mounted without a preceding `middleware()` call. The default non-composable `astro()` pipeline is entirely unaffected; only deployments following the vulnerable pipeline composition pattern - which was demonstrated in the official `examples/advanced-routing` example and Cloudflare Hono documentation - are exposed. The attack is blind write-only: the attacker can mutate server state but cannot read the cross-origin response body. No public exploit or CISA KEV listing exists at time of analysis; the issue is fixed in Astro 7.0.6.
Reflected XSS in Astro's server-side View Transition CSS generator affects all server-rendered or on-demand Astro applications running versions 2.9.0 through 7.0.9. The framework interpolates attacker-controlled animation property values (such as duration, easing, delay, direction, fillMode, and name) directly into an inline <style> element without CSS or HTML escaping, allowing a crafted value containing </style> to break out of the style context and inject arbitrary HTML or JavaScript. A public proof-of-concept exists per the GHSA advisory; no public exploit identified at time of analysis beyond that PoC. The issue is fixed in Astro 7.1.0.
Astro's remotePatterns path enforcement contains a logic flaw where wildcard matching for /* is unanchored, allowing attackers to bypass path restrictions and access unintended resources on allowed hosts. Versions 2.10.10 through 5.18.0 are affected, enabling information disclosure through server-side image optimization endpoints and other remote fetchers. The vulnerability has been patched in version 5.18.1, and while no public exploit code or active exploitation has been reported in KEV databases, the straightforward nature of the bypass makes this a moderate to high priority for affected deployments.
The @astrojs/vercel serverless adapter in Astro versions prior to 10.0.2 contains an unauthenticated path traversal vulnerability that allows attackers to bypass platform-level security restrictions by manipulating the x-astro-path header and x_astro_path query parameter. Any remote attacker without authentication can rewrite internal request paths to access restricted endpoints such as /admin/*, with the attack preserving the original HTTP method and request body, enabling POST, PUT, and DELETE operations against protected resources. The vulnerability has been patched in version 10.0.2, and proof-of-concept code is available via the referenced GitHub security advisory and pull request.
Astro web framework versions prior to 10.0.0 contain an unbounded JSON parsing vulnerability in the Server Islands POST handler that allows unauthenticated remote attackers to exhaust server memory and cause denial of service. The vulnerability affects all Astro SSR applications using the Node standalone adapter, regardless of whether Server Islands functionality is actually used, because the request body is parsed before route validation occurs. An attacker can craft a payload containing many small JSON objects to achieve approximately 15x memory amplification, crashing the process with a single malicious request.