Skip to content
Astro vulnerabilities
Newest
-
astro
Astro: XSS via Unescaped Attribute Names in Spread Props
CVE-2026-54298
Fix available
4.2 Medium
-
astro
Astro: Host-header full-read SSRF in core prerendered error-page fetch (prerenderedErrorPageFetch default + unvalidated createRequestFromNodeRequest URL)
CVE-2026-54299
Fix available
7.5 High
-
astro
Astro: Reflected XSS via unescaped slot name
CVE-2026-50146
Fix available
7.1 High
-
astro
Astro: Server island encrypted parameters vulnerable to cross-component replay
CVE-2026-45028
Fix available
2.9 Low
-
astro
Astro: XSS via incomplete `</script>` sanitization in `define:vars` allows case-insensitive and whitespace-based bypass
CVE-2026-41067
Fix available
6.1 Medium
-
astro
Astro: Remote allowlist bypass via unanchored matchPathname wildcard
CVE-2026-33769
Fix available
2.9 Low
-
withastro astro, astro \@astrojs\/vercel +1 more
Astro: Unauthenticated Path Override via `x-astro-path` / `x_astro_path`
CVE-2026-33768
Fix available
6.5 Medium
-
withastro astro, astro \@astrojs\/node +1 more
Astro: Memory exhaustion DoS due to missing request body size limit in Server Islands
CVE-2026-29772
Fix available
5.9 Medium
-
withastro astro, astro \@astrojs\/node +1 more
Astro is vulnerable to SSRF due to missing allowlist enforcement in remote image inferSize
CVE-2026-27829
Fix available
6.5 Medium
-
withastro astro, astro \@astrojs\/node +1 more
Astro has memory exhaustion DoS due to missing request body size limit in Server Actions
CVE-2026-27729
Fix available
5.9 Medium
-
withastro astro, astro \@astrojs\/node +1 more
Astro has Full-Read SSRF in error rendering via Host: header injection
CVE-2026-25545
Fix available
6.9 Medium
-
astro
Astro has an Authentication Bypass via Double URL Encoding, a bypass for CVE-2025-64765
CVE-2025-66202
Fix available
6.5 Medium
-
astro
Astro middleware authentication checks based on url.pathname can be bypassed via url encoded values
CVE-2025-64765
Fix available
6.9 Medium
-
astro
Astro is vulnerable to Reflected XSS via the server islands feature
CVE-2025-64764
Fix available
7.1 High
-
astro
Astro Cloudflare adapter has a Stored Cross Site Scripting vulnerability in /_image endpoint
CVE-2025-65019
Fix available
5.4 Medium
-
astro
Astro Development Server is Vulnerable to Arbitrary Local File Read
CVE-2025-64757
Fix available
3.5 Low
-
astro
Astro development server error page vulnerable to reflected Cross-site Scripting
CVE-2025-64745
Fix available
2.7 Low
-
astro
Astro: URL manipulation via unsanitized headers leads to path-based middleware protections bypass, potential SSRF/cache-poisoning, CVE-2025-61925 bypass
CVE-2025-64525
Fix available
6.5 Medium
-
astro
astro allows bypass of image proxy domain validation leading to SSRF and potential XSS
CVE-2025-59837
Fix available
7.2 High
-
astro
Astro's `X-Forwarded-Host` is reflected with no validation
CVE-2025-61925
Fix available
6.5 Medium
-
withastro astro, astro \@astrojs\/cloudflare +1 more
Astro Cloudflare adapter is vulnerable to Server-Side Request Forgery via /_image endpoint
CVE-2025-58179
Public exploitFix available
7.2 High
-
astro
Unauthorized third-party images in Astro’s _image endpoint
CVE-2025-55303
Fix available
6.9 Medium
-
astro
Astro: Duplicate trailing slash feature can lead to Open Redirects
CVE-2025-54793
Public exploitFix available
5.5 Medium
-
astro
Server source code is exposed to the public if sourcemaps are enabled
CVE-2024-56159
Fix available
7.8 High
-
astro
Bypass of CSRF Middleware in Astro
CVE-2024-56140
Fix available
5.9 Medium
-
astro
astro's client-side router has DOM Clobbering Gadget that leads to XSS
CVE-2024-47885
Fix available
5.9 Medium