astro has 14 CVEs on record between 2025 and 2026. Disclosures have slowed: 2 in the last 90 days after 8 in the 90 before. The busiest recent month was July 2026 with 5. The median CVSS is 7.1 (high), with 1 rated critical. None have a confirmed exploitation report. The dominant weakness classes are CWE-79 (6) and CWE-918 (3).
CVEs per month
Last 12 months, by publish date
- Exploited share
- 0% vs 1% corpus
- Median CVSS
- 7.1
- Publish → KEV
- —
- Last 90 days
- 2 prev 8
Worst active — by depth score
GHSA-26w7-cxv4-gfx2Critical· 9.8Astro: Remote code execution through AVIF image optimization54CVE-2025-64525Medium· 6.5Astro is a web framework48CVE-2026-59731High· 8.2Astro: Authorization Bypass via Decode Iteration Limit and Rewrite Path Canonicalization Mismatch45CVE-2026-54299High· 7.5Astro: Host header SSRF in prerendered error page fetch41CVE-2025-59837High· 7.2Astro is a web framework that includes an image proxy40
astro vulnerabilities
CVEs affecting astro, newest first. Open any entry for full detail, references, and exploit status.
14 CVEsRSS
GHSA-26w7-cxv4-gfx2Critical· 9.8Astro: Remote code execution through AVIF image optimization
Astro: Remote code execution through AVIF image optimization
CVE-2026-84376MediumAstro is a web framework for content-driven websites
Astro is a web framework for content-driven websites. Prior to 7.2.4, Astro stripped a configured non-root base path from request pathnames using a string-prefix check without verifying a path-segment boundary. With base "/app", a reques…
CVE-2026-59727LowAstro: Cross-site scripting via unescaped transition:* directive values on hydrated islands
Astro: Cross-site scripting via unescaped transition:* directive values on hydrated islands
CVE-2026-59729MediumAstro: XSS via unescaped spread attribute names in renderHTMLElement (incomplete fix for CVE-2026-54298)
Astro: XSS via unescaped spread attribute names in renderHTMLElement (incomplete fix for CVE-2026-54298)
GHSA-8mv7-9c27-98vcMediumAstro: composable `astro/hono` pipeline bypasses `security.checkOrigin` when `middleware()` is absent or misordered
Astro: composable `astro/hono` pipeline bypasses `security.checkOrigin` when `middleware()` is absent or misordered
CVE-2026-59731High· 8.2Astro: Authorization Bypass via Decode Iteration Limit and Rewrite Path Canonicalization Mismatch
Astro: Authorization Bypass via Decode Iteration Limit and Rewrite Path Canonicalization Mismatch
GHSA-4g3v-8h47-v7g6MediumAstro: Reflected XSS via unescaped View Transition animation properties
Astro: Reflected XSS via unescaped View Transition animation properties
CVE-2026-50146High· 7.1Astro: Reflected XSS via unescaped slot name
Astro: Reflected XSS via unescaped slot name
CVE-2026-54299High· 7.5Astro: Host header SSRF in prerendered error page fetch
Astro: Host header SSRF in prerendered error page fetch
CVE-2026-54298Medium· 4.2Astro: XSS via Unescaped Attribute Names in Spread Props
Astro: XSS via Unescaped Attribute Names in Spread Props
CVE-2025-66202Medium· 6.5Astro is a web framework
Astro is a web framework. Versions 5.15.7 and below have a double URL encoding bypass which allows any unauthenticated attacker to bypass path-based authentication checks in Astro middleware, granting unauthorized access to protected rou…
CVE-2025-64525Medium· 6.5PoCAstro is a web framework
Astro is a web framework. In Astro versions 2.16.0 up to but excluding 5.15.5 which utilizeon-demand rendering, request headers `x-forwarded-proto` and `x-forwarded-port` are insecurely used, without sanitization, to build the URL. This …
CVE-2025-59837High· 7.2Astro is a web framework that includes an image proxy
Astro is a web framework that includes an image proxy. In versions 5.13.4 and later before 5.13.10, the image proxy domain validation can be bypassed by using backslashes in the href parameter, allowing server-side requests to arbitrary …
CVE-2025-61925Medium· 6.5Astro is a web framework
Astro is a web framework. Prior to version 5.14.2, Astro reflects the value in `X-Forwarded-Host` in output when using `Astro.url` without any validation. It is common for web servers such as nginx to route requests via the `Host` header…