AS
Vendor
Astro
26
CVEs
0
On KEV
0
New 30D
Products
AS7.5
Astro
Astro
20 CVEs0 on KEV0 new
AS8.6
@astrojs/node
Astro
4 CVEs0 on KEV0 new
AS6.5
@astrojs/cloudflare
Astro
1 CVEs0 on KEV0 new
AS9.1
@astrojs/vercel
Astro
1 CVEs0 on KEV0 new
Recent CVEs
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2026-54299 | AS Astro Astro | 7.5 | Jun 22 | Astro: Host-header full-read SSRF in core prerendered error-page fetch (prerenderedErrorPageFetch default + unvalidated createRequestFromNodeRequest URL) |
| CVE-2026-54298 | AS Astro Astro | 6.1 | Jun 22 | Astro: XSS via Unescaped Attribute Names in Spread Props |
| CVE-2026-50146 | AS Astro Astro | 6.1 | Jun 22 | Astro: Reflected XSS via unescaped slot name |
| CVE-2026-45028 | AS Astro Astro | 6.1 | May 13 | Astro: Server island encrypted parameters vulnerable to cross-component replay |
| CVE-2026-41067 | AS Astro Astro | 6.1 | Apr 24 | Astro: XSS via incomplete `</script>` sanitization in `define:vars` allows case-insensitive and whitespace-based bypass |
| CVE-2026-33769 | AS Astro Astro | 5.3 | Mar 24 | Astro: Remote allowlist bypass via unanchored matchPathname wildcard |
| CVE-2026-33768 | AS @astrojs/vercel Astro | 9.1 | Mar 24 | Astro: Unauthenticated Path Override via `x-astro-path` / `x_astro_path` |
| CVE-2026-29772 | AS @astrojs/node Astro | 7.5 | Mar 24 | Astro: Memory exhaustion DoS due to missing request body size limit in Server Islands |
| CVE-2026-27829 | AS @astrojs/node Astro | 7.2 | Feb 26 | Astro is vulnerable to SSRF due to missing allowlist enforcement in remote image inferSize |
| CVE-2026-27729 | AS @astrojs/node Astro | 7.5 | Feb 24 | Astro has memory exhaustion DoS due to missing request body size limit in Server Actions |
| CVE-2026-25545 | AS @astrojs/node Astro | 8.6 | Feb 24 | Astro has Full-Read SSRF in error rendering via Host: header injection |
| CVE-2025-66202 | AS Astro Astro | 6.5 | Dec 8 | Astro has an Authentication Bypass via Double URL Encoding, a bypass for CVE-2025-64765 |
| CVE-2025-64765 | AS Astro Astro | 5.3 | Nov 19 | Astro middleware authentication checks based on url.pathname can be bypassed via url encoded values |
| CVE-2025-64764 | AS Astro Astro | 5.4 | Nov 19 | Astro is vulnerable to Reflected XSS via the server islands feature |
| CVE-2025-65019 | AS Astro Astro | 6.1 | Nov 19 | Astro Cloudflare adapter has a Stored Cross Site Scripting vulnerability in /_image endpoint |
| CVE-2025-64757 | AS Astro Astro | 3.5 | Nov 19 | Astro Development Server is Vulnerable to Arbitrary Local File Read |
| CVE-2025-64745 | AS Astro Astro | 6.1 | Nov 13 | Astro development server error page vulnerable to reflected Cross-site Scripting |
| CVE-2025-64525 | AS Astro Astro | 6.5 | Nov 13 | Astro: URL manipulation via unsanitized headers leads to path-based middleware protections bypass, potential SSRF/cache-poisoning, CVE-2025-61925 bypass |
| CVE-2025-59837 | AS Astro Astro | 7.2 | Oct 28 | astro allows bypass of image proxy domain validation leading to SSRF and potential XSS |
| CVE-2025-61925 | AS Astro Astro | 6.5 | Oct 10 | Astro's `X-Forwarded-Host` is reflected with no validation |
| CVE-2025-58179 | AS @astrojs/cloudflare Astro | 6.5 | Sep 4 | Astro Cloudflare adapter is vulnerable to Server-Side Request Forgery via /_image endpoint |
| CVE-2025-55303 | AS Astro Astro | 6.1 | Aug 19 | Unauthorized third-party images in Astro’s _image endpoint |
| CVE-2025-54793 | AS Astro Astro | 6.1 | Aug 8 | Astro: Duplicate trailing slash feature can lead to Open Redirects |
| CVE-2024-56159 | AS Astro Astro | 5.3 | Dec 19 | Server source code is exposed to the public if sourcemaps are enabled |
| CVE-2024-56140 | AS Astro Astro | 6.5 | Dec 18 | Bypass of CSRF Middleware in Astro |
| CVE-2024-47885 | AS Astro Astro | 5.4 | Oct 14 | astro's client-side router has DOM Clobbering Gadget that leads to XSS |