Vulnerabilities

TI-2026-78912 CVE-2026-114128 · GHSA-98hj-9722-w3j8

Cross-site scripting in Astro via unescaped script and style children

LOW 29

Astro is a web framework for content-driven websites.

CVSS 3.1MEDIUM 6.5 Network No auth User interaction EPSS 0.00321 Published 2026-10-21 Partial fix · 7.3.2 CWE-79

TI-2026-78907 CVE-2026-114127 · GHSA-mpr7-6m5w-76rw

Arbitrary CSS injection in Astro View Transitions

MEDIUM 45

Astro is a web framework for content-driven websites.

CVSS 4.0LOW 2.3 Network No auth User interaction EPSS 0.00498 Published 2026-10-21 Partial fix · 7.3.3 CWE-79

TI-2026-65546 CVE-2026-102984 · GHSA-qh8j-hqjv-7m4x

Astro: Malformed port in the Host header can crash the Node adapter

LOW 36

Astro is a web framework for content-driven websites.

CVSS 4.0HIGH 8.2 Network No auth No interaction EPSS 0.00362 Published 2026-09-30 Fixed in 11.1.3 CWE-248

TI-2026-65545 CVE-2026-102983 · GHSA-4233-jc72-56c5

Astro: Netlify Image CDN allowlist bypass enables SSRF

LOW 28

Astro is a web framework for content-driven websites.

CVSS 4.0MEDIUM 6.3 Network No auth No interaction EPSS 0.0031 Published 2026-09-30 Fixed in 8.2.4 CWE-625

TI-2026-57987 CVE-2026-84376 · GHSA-376h-93r7-7g6f

Astro: Authorization bypass from missing path-segment boundary check when stripping the configured base

LOW 37

Astro is a web framework for content-driven websites.

CVSS 4.0MEDIUM 6.3 Network No auth No interaction EPSS 0.00707 Published 2026-09-02 Fixed in 7.2.4 CWE-187

TI-2026-51542 CVE-2026-73424 · GHSA-x27w-589x-frm2

Astro: Unauthenticated path override in the @astrojs/vercel ISR function

HIGH 68

Astro is a web framework for content-driven websites.

CVSS 3.1MEDIUM 6.5 Network No auth No interaction EPSS 0.00384 Published 2026-08-17 Fixed in 11.0.3 CWE-441

TI-2026-51543 CVE-2026-73425 · GHSA-hp3v-mfqw-h74c

@astrojs/netlify generates an overly-broad Netlify Image CDN allowlist because…

LOW 17

Astro is a web framework for content-driven websites.

CVSS 3.1LOW 3.7 Network No auth No interaction EPSS 0.00269 Published 2026-08-12 Fixed in 8.1.2 CWE-185

TI-2026-51541 CVE-2026-73423 · GHSA-8mv7-9c27-98vc

Astro: composable `astro/hono` pipeline bypasses `security.checkOrigin` when `middleware()` is absent or misordered

LOW 29

Astro is a web framework for content-driven websites.

CVSS 4.0MEDIUM 5.1 Network No auth User interaction EPSS 0.00264 Published 2026-08-12 Partial fix · 7.0.6 CWE-352

TI-2026-51540 CVE-2026-73422 · GHSA-4g3v-8h47-v7g6

Astro: Reflected XSS via unescaped View Transition animation properties

MEDIUM 57

Astro is a web framework for content-driven websites.

CVSS 4.0MEDIUM 5.3 Network No auth User interaction EPSS 0.00547 Published 2026-08-12 Fixed in 7.1.0 CWE-79

TI-2026-42599 CVE-2026-59730 · GHSA-r557-wffq-wvrc

@astrojs/node: Backslash-prefixed paths not recognized as internal by trailing-slash redirect

LOW 12

Astro is a web framework for content-driven websites.

CVSS 4.0LOW 2.1 Network No auth User interaction EPSS 0.0046 Published 2026-07-27 Fixed in 11.0.2 CWE-601

TI-2026-42597 CVE-2026-59728 · GHSA-8j5q-mfj2-5q9q

@astrojs/rss: XML Injection via Unescaped RSS Feed Fields

MEDIUM 53

Astro is a web framework for content-driven websites.

CVSS 3.1MEDIUM 4.3 Network No auth User interaction EPSS 0.00322 Published 2026-07-27 Fixed in 4.0.19 CWE-91

TI-2026-42596 CVE-2026-59727 · GHSA-7pw4-f3q4-r2p2

Astro: Cross-site scripting via unescaped transition:* directive values on hydrated islands

MEDIUM 44

Astro is a web framework for content-driven websites.

CVSS 4.0LOW 2.1 Network No auth User interaction EPSS 0.00393 Published 2026-07-27 Fixed in 7.0.4 CWE-116

TI-2026-42598 CVE-2026-59729 · GHSA-f48w-9m4c-m7f5

Astro: XSS via unescaped spread attribute names in renderHTMLElement (incomplete fix for CVE-2026-54298)

MEDIUM 56

Astro is a web framework for content-driven websites.

CVSS 4.0MEDIUM 5.1 Network No auth User interaction EPSS 0.00473 Published 2026-07-27 Fixed in 7.0.6 CWE-79

TI-2026-42600 CVE-2026-59731 · GHSA-vj59-8hwv-xxmv

Astro 6.4.7 Authorization Bypass via Decode Iteration Limit and Rewrite Path Canonicalization Mismatch

HIGH 75

Astro is a web framework for content-driven websites.

CVSS 3.1HIGH 8.2 Network No auth No interaction EPSS 0.00331 Published 2026-07-08 Fixed in 6.4.8 CWE-647

TI-2026-39195 CVE-2026-54299 · GHSA-2pvr-wf23-7pc7

Improper input validation in withastro astro

LOW 33

Astro is a web framework.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00333 Published 2026-06-22 Fixed in 6.4.6 CWE-20

TI-2026-39194 CVE-2026-54298 · GHSA-jrpj-wcv7-9fh9

Astro: XSS via Unescaped Attribute Names in Spread Props

MEDIUM 60

Astro is a web framework.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00228 Published 2026-06-22 Fixed in 6.4.6 CWE-79

TI-2026-36915 CVE-2026-50146 · GHSA-8hv8-536x-4wqp

Astro: Reflected XSS via unescaped slot name

MEDIUM 64

Astro is a web framework.

CVSS 3.1HIGH 7.1 Network No auth User interaction EPSS 0.00268 Published 2026-06-22 Fixed in 6.3.3 CWE-80

TI-2026-39196 CVE-2026-54300 · GHSA-529g-xq4f-cw38

@astrojs/netlify broadens Astro image.remotePatterns in Netlify Image CDN config

MEDIUM 63

@astrojs/netlify is an adapter that allows Astro to deploy your hybrid or server rendered site to Netlify.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00313 Published 2026-06-22 Fixed in 7.0.13 CWE-918

TI-2026-32882 CVE-2026-45028 · GHSA-xr5h-phrj-8vxv

Astro: Server island encrypted parameters vulnerable to cross-component replay

LOW 19

Astro is a web framework.

CVSS 4.0LOW 2.9 Network No auth No interaction EPSS 0.00144 Published 2026-05-13 Fixed in 6.1.10 CWE-323

TI-2026-29923 CVE-2026-41322 · GHSA-c57f-mm3j-27q9

@astrojs/node: Cache Poisoning due to incorrect error handling when if-match header is malformed

MEDIUM 63

@astrojs/node allows Astro to deploy your SSR site to Node targets.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00286 Published 2026-04-24 Fixed in 10.0.5 CWE-525

TI-2026-29922 CVE-2026-41321 · GHSA-88gm-j2wx-58h6

@astrojs/cloudflare: SSRF via redirect following in Cloudflare image-binding-transform endpoint

MEDIUM 45

@astrojs/cloudflare is an SSR adapter for use with Cloudflare Workers targets.

CVSS 3.1LOW 2.2 Network High privileges No interaction EPSS 0.00242 Published 2026-04-24 Fixed in 13.1.10 CWE-918

TI-2026-29706 CVE-2026-41067 · GHSA-j687-52p2-xcff

Astro: XSS via incomplete `</script>` sanitization in `define:vars` allows case-insensitive and whitespace-based bypass

MEDIUM 60

Astro is a web framework.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00189 Published 2026-04-24 Fixed in 6.1.6 CWE-79

TI-2026-26148 CVE-2026-33769 · GHSA-g735-7g2w-hh3f

Astro: Remote allowlist bypass via unanchored matchPathname wildcard

MEDIUM 48

Astro is a web framework.

CVSS 4.0LOW 2.9 Network No auth No interaction EPSS 0.00338 Published 2026-03-24 Fixed in 5.18.1 CWE-20

TI-2026-26147 CVE-2026-33768 · GHSA-mr6q-rp88-fx84

Astro: Unauthenticated Path Override via `x-astro-path` / `x_astro_path`

HIGH 78

Astro is a web framework.

CVSS 3.1CRITICAL 9.1 Network No auth No interaction EPSS 0.00344 Published 2026-03-24 Fixed in 10.0.2 CWE-441

TI-2026-23358 CVE-2026-29772 · GHSA-3rmj-9m5h-8fpv

Astro: Memory exhaustion DoS due to missing request body size limit in Server Islands

HIGH 66

Astro is a web framework.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00385 Published 2026-03-24 Fixed in 10.0.0 CWE-770

Vulnerabilities

Filters