withastro

Records44All Threatist records

Exploited (KEV)0None in CISA KEV

CVSS critical1CVSS 9.0–10.0

CVSS high11CVSS 7.0–8.9

Exploited now

withastro records in CISA KEV

No withastro vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records

Astro 20 records HIGH @astrojs/node 4 records HIGH @astrojs/cloudflare 1 record HIGH @astrojs/vercel 1 record HIGH

Records

44 records

TI-2026-26147 CVE-2026-33768 · GHSA-mr6q-rp88-fx84

Astro: Unauthenticated Path Override via `x-astro-path` / `x_astro_path`

HIGH 78

Astro is a web framework.

CVSS 3.1CRITICAL 9.1 Network No auth No interaction EPSS 0.00344 Published 2026-03-24 Fixed in 10.0.2 CWE-441

TI-2026-42600 CVE-2026-59731 · GHSA-vj59-8hwv-xxmv

Astro 6.4.7 Authorization Bypass via Decode Iteration Limit and Rewrite Path Canonicalization Mismatch

HIGH 75

Astro is a web framework for content-driven websites.

CVSS 3.1HIGH 8.2 Network No auth No interaction EPSS 0.00331 Published 2026-07-08 Fixed in 6.4.8 CWE-647

TI-2024-37142 CVE-2024-56159 · GHSA-49w6-73cw-chjr

Server source code is exposed to the public if sourcemaps are enabled

HIGH 73

Astro is a web framework for content-driven websites.

CVSS 4.0HIGH 7.8 Network No auth No interaction EPSS 0.01536 Published 2024-12-19 Fixed in 5.0.8, 4.16.18 CWE-219

TI-2025-35987 CVE-2025-58179 · GHSA-qpr4-c339-7vq8

Astro Cloudflare adapter is vulnerable to Server-Side Request Forgery via /_image endpoint

HIGH 71

Astro is a web framework for content-driven websites.

CVSS 3.1HIGH 7.2 Network No auth No interaction EPSS 0.0087 Published 2025-09-04 Fixed in 12.6.6 CWE-918

TI-2025-34958 CVE-2025-55303 · GHSA-xf8x-j4p2-f749

Unauthorized third-party images in Astro’s _image endpoint

HIGH 70

Astro is a web framework for content-driven websites.

CVSS 4.0MEDIUM 6.9 Network No auth No interaction EPSS 0.00637 Published 2025-08-19 Fixed in 5.13.2, 4.16.18 +2 CWE-115

TI-2026-51542 CVE-2026-73424 · GHSA-x27w-589x-frm2

Astro: Unauthenticated path override in the @astrojs/vercel ISR function

HIGH 68

Astro is a web framework for content-driven websites.

CVSS 3.1MEDIUM 6.5 Network No auth No interaction EPSS 0.00384 Published 2026-08-17 Fixed in 11.0.3 CWE-441

TI-2025-39915 CVE-2025-64525 · GHSA-hr2q-hp5q-x767

Server-side request forgery in withastro astro

HIGH 68

Astro is a web framework.

CVSS 3.1MEDIUM 6.5 Network No auth No interaction EPSS 0.01245 Published 2025-11-13 Fixed in 5.15.5 CWE-918

TI-2025-38274 CVE-2025-61925 · GHSA-5ff5-9fcw-vg88

Astro's `X-Forwarded-Host` is reflected with no validation

HIGH 68

Astro is a web framework.

CVSS 3.1MEDIUM 6.5 Network No auth No interaction EPSS 0.00408 Published 2025-10-10 Fixed in 5.14.2, 5.14.3 CWE-470

TI-2026-23358 CVE-2026-29772 · GHSA-3rmj-9m5h-8fpv

Astro: Memory exhaustion DoS due to missing request body size limit in Server Islands

HIGH 66

Astro is a web framework.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00385 Published 2026-03-24 Fixed in 10.0.0 CWE-770

TI-2026-22091 CVE-2026-27729 · GHSA-jm64-8m5q-4qh8

Astro has memory exhaustion DoS due to missing request body size limit in Server Actions

HIGH 66

Astro is a web framework.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00482 Published 2026-02-24 Fixed in 9.5.4 CWE-770

TI-2026-22180 CVE-2026-27829 · GHSA-cj9f-h6r6-4cx2

Astro is vulnerable to SSRF due to missing allowlist enforcement in remote image inferSize

HIGH 65

Astro is a web framework.

CVSS 3.1HIGH 7.2 Network No auth No interaction EPSS 0.0032 Published 2026-02-26 Fixed in 9.5.4 CWE-918

TI-2026-36915 CVE-2026-50146 · GHSA-8hv8-536x-4wqp

Astro: Reflected XSS via unescaped slot name

MEDIUM 64

Astro is a web framework.

CVSS 3.1HIGH 7.1 Network No auth User interaction EPSS 0.00268 Published 2026-06-22 Fixed in 6.3.3 CWE-80

TI-2026-20654 CVE-2026-25545 · GHSA-qq67-mvv5-fw3g

Astro has Full-Read SSRF in error rendering via Host: header injection

MEDIUM 64

Astro is a web framework.

CVSS 4.0MEDIUM 6.9 Network No auth No interaction EPSS 0.01933 Published 2026-02-24 Fixed in 9.5.4 CWE-918

TI-2025-40102 CVE-2025-64764 · GHSA-wrwg-2hg8-v723

Astro is vulnerable to Reflected XSS via the server islands feature

MEDIUM 64

Astro is a web framework.

CVSS 3.1HIGH 7.1 Network No auth User interaction EPSS 0.00528 Published 2025-11-19 Fixed in 5.15.8 CWE-80

TI-2025-34548 CVE-2025-54793 · GHSA-cq8c-xv66-36gw

Astro: Duplicate trailing slash feature can lead to Open Redirects

MEDIUM 64

Astro is a web framework for content-driven websites.

CVSS 4.0MEDIUM 5.5 Network No auth No interaction EPSS 0.00696 Published 2025-08-08 Fixed in 5.12.8 CWE-601

TI-2026-39196 CVE-2026-54300 · GHSA-529g-xq4f-cw38

@astrojs/netlify broadens Astro image.remotePatterns in Netlify Image CDN config

MEDIUM 63

@astrojs/netlify is an adapter that allows Astro to deploy your hybrid or server rendered site to Netlify.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00313 Published 2026-06-22 Fixed in 7.0.13 CWE-918

TI-2026-29923 CVE-2026-41322 · GHSA-c57f-mm3j-27q9

@astrojs/node: Cache Poisoning due to incorrect error handling when if-match header is malformed

MEDIUM 63

@astrojs/node allows Astro to deploy your SSR site to Node targets.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00286 Published 2026-04-24 Fixed in 10.0.5 CWE-525

TI-2024-37133 CVE-2024-56140 · GHSA-c4pw-33h3-35xw

Bypass of CSRF Middleware in Astro

MEDIUM 62

Astro is a web framework for content-driven websites.

CVSS 3.1MEDIUM 6.5 Network No auth User interaction EPSS 0.00223 Published 2024-12-18 Fixed in 4.16.17 CWE-352

TI-2026-39194 CVE-2026-54298 · GHSA-jrpj-wcv7-9fh9

Astro: XSS via Unescaped Attribute Names in Spread Props

MEDIUM 60

Astro is a web framework.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00228 Published 2026-06-22 Fixed in 6.4.6 CWE-79

TI-2026-29706 CVE-2026-41067 · GHSA-j687-52p2-xcff

Astro: XSS via incomplete `</script>` sanitization in `define:vars` allows case-insensitive and whitespace-based bypass

MEDIUM 60

Astro is a web framework.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00189 Published 2026-04-24 Fixed in 6.1.6 CWE-79

TI-2025-40205 CVE-2025-65019 · GHSA-fvmw-cj7j-j39q

Astro Cloudflare adapter has a Stored Cross Site Scripting vulnerability in /_image endpoint

MEDIUM 60

Astro is a web framework.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00274 Published 2025-11-19 Fixed in 5.15.9 CWE-79

TI-2025-40083 CVE-2025-64745 · GHSA-w2vj-39qv-7vh7

Astro development server error page vulnerable to reflected Cross-site Scripting

MEDIUM 60

Astro is a web framework.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00262 Published 2025-11-13 Fixed in 5.15.6 CWE-79

TI-2024-32139 CVE-2024-47885 · GHSA-m85w-3h95-hcf9

astro's client-side router has DOM Clobbering Gadget that leads to XSS

MEDIUM 60

The Astro web framework has a DOM Clobbering gadget in the client-side router starting in version 3.0.0 and prior to version 4.16.1.

CVSS 3.1MEDIUM 5.9 Network Low privileges User interaction EPSS 0.00445 Published 2024-10-14 Fixed in 4.16.1 CWE-79

TI-2025-34882 CVE-2025-55207 · GHSA-9x9c-ghc5-jhw9

@astrojs/node's trailing slash handling causes open redirect issue

MEDIUM 58

Astro is a web framework for content-driven websites.

CVSS 4.0MEDIUM 5.5 Network No auth No interaction EPSS 0.00607 Published 2025-08-15 Fixed in 9.4.1 CWE-601

TI-2026-51540 CVE-2026-73422 · GHSA-4g3v-8h47-v7g6

Astro: Reflected XSS via unescaped View Transition animation properties

MEDIUM 57

Astro is a web framework for content-driven websites.

CVSS 4.0MEDIUM 5.3 Network No auth User interaction EPSS 0.00547 Published 2026-08-12 Fixed in 7.1.0 CWE-79

Open these records in search →

Critical	1
High	11
Medium	24
Low	8
No CVSS	0