Withastro Astro vulnerabilities

• withastro astro Astro: Reflected/Stored XSS via unescaped <script>/<style> tag content in JSX/MDX rendering CVE-2026-114128 Fix available 6.5 MediumOctober 21, 2026
• withastro astro Astro: Arbitrary CSS injection in Astro View Transitions CVE-2026-114127 Fix available 2.3 LowOctober 21, 2026
• withastro astro Astro: Malformed port in the Host header can crash the Node adapter CVE-2026-102984 Fix available 8.2 HighSeptember 30, 2026
• @astrojs netlify, withastro astro +1 more Astro: Netlify Image CDN allowlist bypass enables SSRF CVE-2026-102983 Fix available 6.3 MediumSeptember 30, 2026
• withastro astro Astro: Authorization bypass from missing path-segment boundary check when stripping the configured base CVE-2026-84376 Fix available 6.3 MediumSeptember 2, 2026
• withastro astro Astro: composable `astro/hono` pipeline bypasses `security.checkOrigin` when `middleware()` is absent or misordered CVE-2026-73423 Fix available 5.1 MediumJuly 20, 2026
• withastro astro Astro: Unauthenticated path override in the @astrojs/vercel ISR function CVE-2026-73424 Fix available 6.5 MediumJuly 20, 2026
• withastro astro @astrojs/netlify generates an overly-broad Netlify Image CDN allowlist because remotePatterns.pathname metacharacters are not escaped CVE-2026-73425 Fix available 3.7 LowJuly 20, 2026
• withastro astro @astrojs/node: Backslash-prefixed paths not recognized as internal by trailing-slash redirect CVE-2026-59730 Fix available 2.1 LowJuly 20, 2026
• withastro astro Astro: XSS via unescaped spread attribute names in renderHTMLElement (incomplete fix for CVE-2026-54298) CVE-2026-59729 Fix available 5.1 MediumJuly 20, 2026
• withastro astro @astrojs/rss: XML Injection via Unescaped RSS Feed Fields CVE-2026-59728 Fix available 4.3 MediumJuly 20, 2026
• withastro astro Astro: Cross-site scripting via unescaped transition:* directive values on hydrated islands CVE-2026-59727 Fix available 2.1 LowJuly 20, 2026
• withastro astro Astro: Reflected XSS via unescaped View Transition animation properties CVE-2026-73422 Fix available 5.3 MediumJuly 20, 2026
• withastro astro Astro 6.4.7 Authorization Bypass via Decode Iteration Limit and Rewrite Path Canonicalization Mismatch CVE-2026-59731 Fix available 8.2 HighJuly 8, 2026
• astro Astro: XSS via Unescaped Attribute Names in Spread Props CVE-2026-54298 Fix available 4.2 MediumJune 16, 2026
• astro Astro: Host-header full-read SSRF in core prerendered error-page fetch (prerenderedErrorPageFetch default + unvalidated createRequestFromNodeRequest URL) CVE-2026-54299 Fix available 7.5 HighJune 16, 2026
• withastro astro @astrojs/netlify broadens Astro image.remotePatterns in Netlify Image CDN config CVE-2026-54300 Fix available 5.3 MediumJune 16, 2026
• astro Astro: Reflected XSS via unescaped slot name CVE-2026-50146 Fix available 7.1 HighJune 16, 2026
• astro Astro: Server island encrypted parameters vulnerable to cross-component replay CVE-2026-45028 Fix available 2.9 LowMay 13, 2026
• @clerk backend, nextjs, shared +31 more +33 more Clerk: Authorization bypass when combining organization, billing, or reverification checks CVE-2026-42349 Fix available 7.6 HighApril 30, 2026
• withastro @astrojs/cloudflare @astrojs/cloudflare: SSRF via redirect following in Cloudflare image-binding-transform endpoint CVE-2026-41321 Fix available 2.2 LowApril 23, 2026
• withastro astro @astrojs/node: Cache Poisoning due to incorrect error handling when if-match header is malformed CVE-2026-41322 Fix available 5.3 MediumApril 23, 2026
• astro Astro: XSS via incomplete `</script>` sanitization in `define:vars` allows case-insensitive and whitespace-based bypass CVE-2026-41067 Fix available 6.1 MediumApril 21, 2026
• @clerk nextjs, nuxt, shared +1 more +3 more Official Clerk JavaScript SDKs: Middleware-based route protection bypass CVE-2026-41248 Fix available 9.1 CriticalApril 16, 2026
• astro Astro: Remote allowlist bypass via unanchored matchPathname wildcard CVE-2026-33769 Fix available 2.9 LowMarch 24, 2026
• withastro astro, astro \@astrojs\/vercel +1 more Astro: Unauthenticated Path Override via `x-astro-path` / `x_astro_path` CVE-2026-33768 Fix available 6.5 MediumMarch 24, 2026
• withastro astro, astro \@astrojs\/node +1 more Astro: Memory exhaustion DoS due to missing request body size limit in Server Islands CVE-2026-29772 Fix available 5.9 MediumMarch 24, 2026
• withastro astro, astro \@astrojs\/node +1 more Astro is vulnerable to SSRF due to missing allowlist enforcement in remote image inferSize CVE-2026-27829 Fix available 6.5 MediumFebruary 25, 2026
• withastro astro, astro \@astrojs\/node +1 more Astro has memory exhaustion DoS due to missing request body size limit in Server Actions CVE-2026-27729 Fix available 5.9 MediumFebruary 24, 2026
• withastro astro, astro \@astrojs\/node +1 more Astro has Full-Read SSRF in error rendering via Host: header injection CVE-2026-25545 Fix available 6.9 MediumFebruary 23, 2026
• astro Astro has an Authentication Bypass via Double URL Encoding, a bypass for CVE-2025-64765 CVE-2025-66202 Fix available 6.5 MediumDecember 8, 2025
• astro Astro middleware authentication checks based on url.pathname can be bypassed via url encoded values CVE-2025-64765 Fix available 6.9 MediumNovember 19, 2025
• astro Astro is vulnerable to Reflected XSS via the server islands feature CVE-2025-64764 Fix available 7.1 HighNovember 19, 2025
• astro Astro Cloudflare adapter has a Stored Cross Site Scripting vulnerability in /_image endpoint CVE-2025-65019 Fix available 5.4 MediumNovember 19, 2025
• astro Astro Development Server is Vulnerable to Arbitrary Local File Read CVE-2025-64757 Fix available 3.5 LowNovember 19, 2025
• astro Astro development server error page vulnerable to reflected Cross-site Scripting CVE-2025-64745 Fix available 2.7 LowNovember 13, 2025
• astro Astro: URL manipulation via unsanitized headers leads to path-based middleware protections bypass, potential SSRF/cache-poisoning, CVE-2025-61925 bypass CVE-2025-64525 Fix available 6.5 MediumNovember 13, 2025
• astro astro allows bypass of image proxy domain validation leading to SSRF and potential XSS CVE-2025-59837 Fix available 7.2 HighOctober 28, 2025
• astro Astro's `X-Forwarded-Host` is reflected with no validation CVE-2025-61925 Fix available 6.5 MediumOctober 10, 2025
• withastro astro, astro \@astrojs\/cloudflare +1 more Astro Cloudflare adapter is vulnerable to Server-Side Request Forgery via /_image endpoint CVE-2025-58179 Public exploitFix available 7.2 HighSeptember 4, 2025
• astro Unauthorized third-party images in Astro’s _image endpoint CVE-2025-55303 Fix available 6.9 MediumAugust 19, 2025
• withastro astro @astrojs/node's trailing slash handling causes open redirect issue CVE-2025-55207 Fix available 5.5 MediumAugust 15, 2025
• astro Astro: Duplicate trailing slash feature can lead to Open Redirects CVE-2025-54793 Public exploitFix available 5.5 MediumAugust 7, 2025
• astro Server source code is exposed to the public if sourcemaps are enabled CVE-2024-56159 Fix available 7.8 HighDecember 19, 2024
• astro Bypass of CSRF Middleware in Astro CVE-2024-56140 Fix available 5.9 MediumDecember 18, 2024
• astro astro's client-side router has DOM Clobbering Gadget that leads to XSS CVE-2024-47885 Fix available 5.9 MediumOctober 14, 2024