Astro: Unauthenticated Path Override via `x-astro-path` / `x_astro_path`

Astro has Full-Read SSRF in error rendering via Host: header injection

Astro: Malformed port in the Host header can crash the Node adapter

Astro 6.4.7 Authorization Bypass via Decode Iteration Limit and Rewrite Path Canonicalization Mismatch

Astro: Host-header full-read SSRF in core prerendered error-page fetch (prerenderedErrorPageFetch default + unvalidated createRequestFromNodeRequest URL)

Astro: Memory exhaustion DoS due to missing request body size limit in Server Islands

Astro has memory exhaustion DoS due to missing request body size limit in Server Actions

Astro is vulnerable to SSRF due to missing allowlist enforcement in remote image inferSize

astro allows bypass of image proxy domain validation leading to SSRF and potential XSS

Astro: Reflected/Stored XSS via unescaped <script>/<style> tag content in JSX/MDX rendering

Astro: Unauthenticated path override in the @astrojs/vercel ISR function

Astro has an Authentication Bypass via Double URL Encoding, a bypass for CVE-2025-64765

Astro: URL manipulation via unsanitized headers leads to path-based middleware protections bypass, potential SSRF/cache-poisoning, CVE-2025-61925 bypass

Astro's `X-Forwarded-Host` is reflected with no validation

Astro Cloudflare adapter is vulnerable to Server-Side Request Forgery via /_image endpoint

Bypass of CSRF Middleware in Astro

Astro: Netlify Image CDN allowlist bypass enables SSRF

Astro: Authorization bypass from missing path-segment boundary check when stripping the configured base

Astro: XSS via Unescaped Attribute Names in Spread Props

Astro: Reflected XSS via unescaped slot name

Astro: Server island encrypted parameters vulnerable to cross-component replay

Astro: XSS via incomplete `</script>` sanitization in `define:vars` allows case-insensitive and whitespace-based bypass

Astro Cloudflare adapter has a Stored Cross Site Scripting vulnerability in /_image endpoint

Astro development server error page vulnerable to reflected Cross-site Scripting

Unauthorized third-party images in Astro’s _image endpoint

Astro: Duplicate trailing slash feature can lead to Open Redirects

@astrojs/node's trailing slash handling causes open redirect issue

Astro is vulnerable to Reflected XSS via the server islands feature

astro's client-side router has DOM Clobbering Gadget that leads to XSS

Astro: Reflected XSS via unescaped View Transition animation properties

@astrojs/netlify broadens Astro image.remotePatterns in Netlify Image CDN config

@astrojs/node: Cache Poisoning due to incorrect error handling when if-match header is malformed

Astro: Remote allowlist bypass via unanchored matchPathname wildcard

Astro middleware authentication checks based on url.pathname can be bypassed via url encoded values

Server source code is exposed to the public if sourcemaps are enabled

Astro: composable `astro/hono` pipeline bypasses `security.checkOrigin` when `middleware()` is absent or misordered

Astro: XSS via unescaped spread attribute names in renderHTMLElement (incomplete fix for CVE-2026-54298)

@astrojs/rss: XML Injection via Unescaped RSS Feed Fields

@astrojs/netlify generates an overly-broad Netlify Image CDN allowlist because remotePatterns.pathname metacharacters are not escaped

Astro Development Server is Vulnerable to Arbitrary Local File Read

Astro: Arbitrary CSS injection in Astro View Transitions

@astrojs/node: Backslash-prefixed paths not recognized as internal by trailing-slash redirect

Astro: Cross-site scripting via unescaped transition:* directive values on hydrated islands