astro vulnerabilities
CVEs whose affected-version data names the astro package (npm). Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.
16 CVEsRSS
CVE-2026-102983Medium· 6.3Astro is a web framework for content-driven websites
Astro is a web framework for content-driven websites. From 5.2.0 until 8.2.4, the @astrojs/netlify adapter generates regular expressions for Netlify Image CDN remote-image allowlists without anchoring them to the beginning of the URL. Be…
CVE-2026-102984High· 8.2Astro is a web framework for content-driven websites
Astro is a web framework for content-driven websites. Prior to 11.1.3, the @astrojs/node adapter builds a request URL from the Host header, and a malformed port can make that URL invalid. The recovery path reuses the same malformed host …
GHSA-26w7-cxv4-gfx2Critical· 9.8Astro: Remote code execution through AVIF image optimization
Astro: Remote code execution through AVIF image optimization
CVE-2026-84376MediumAstro is a web framework for content-driven websites
Astro is a web framework for content-driven websites. Prior to 7.2.4, Astro stripped a configured non-root base path from request pathnames using a string-prefix check without verifying a path-segment boundary. With base "/app", a reques…
CVE-2026-59727LowAstro: Cross-site scripting via unescaped transition:* directive values on hydrated islands
Astro: Cross-site scripting via unescaped transition:* directive values on hydrated islands
CVE-2026-59729MediumAstro: XSS via unescaped spread attribute names in renderHTMLElement (incomplete fix for CVE-2026-54298)
Astro: XSS via unescaped spread attribute names in renderHTMLElement (incomplete fix for CVE-2026-54298)
GHSA-8mv7-9c27-98vcMediumAstro: composable `astro/hono` pipeline bypasses `security.checkOrigin` when `middleware()` is absent or misordered
Astro: composable `astro/hono` pipeline bypasses `security.checkOrigin` when `middleware()` is absent or misordered
CVE-2026-59731High· 8.2Astro: Authorization Bypass via Decode Iteration Limit and Rewrite Path Canonicalization Mismatch
Astro: Authorization Bypass via Decode Iteration Limit and Rewrite Path Canonicalization Mismatch
GHSA-4g3v-8h47-v7g6MediumAstro: Reflected XSS via unescaped View Transition animation properties
Astro: Reflected XSS via unescaped View Transition animation properties
CVE-2026-50146High· 7.1Astro: Reflected XSS via unescaped slot name
Astro: Reflected XSS via unescaped slot name
CVE-2026-54299High· 7.5Astro: Host header SSRF in prerendered error page fetch
Astro: Host header SSRF in prerendered error page fetch
CVE-2026-54298Medium· 4.2Astro: XSS via Unescaped Attribute Names in Spread Props
Astro: XSS via Unescaped Attribute Names in Spread Props
CVE-2025-66202Medium· 6.5Astro is a web framework
Astro is a web framework. Versions 5.15.7 and below have a double URL encoding bypass which allows any unauthenticated attacker to bypass path-based authentication checks in Astro middleware, granting unauthorized access to protected rou…
CVE-2025-64525Medium· 6.5PoCAstro is a web framework
Astro is a web framework. In Astro versions 2.16.0 up to but excluding 5.15.5 which utilizeon-demand rendering, request headers `x-forwarded-proto` and `x-forwarded-port` are insecurely used, without sanitization, to build the URL. This …
CVE-2025-59837High· 7.2Astro is a web framework that includes an image proxy
Astro is a web framework that includes an image proxy. In versions 5.13.4 and later before 5.13.10, the image proxy domain validation can be bypassed by using backslashes in the href parameter, allowing server-side requests to arbitrary …
CVE-2025-61925Medium· 6.5Astro is a web framework
Astro is a web framework. Prior to version 5.14.2, Astro reflects the value in `X-Forwarded-Host` in output when using `Astro.url` without any validation. It is common for web servers such as nginx to route requests via the `Host` header…