withastro
- Total products in the ecosystem
- 2
- Total vulnerabilities (90 days)
- 9
- Products & ServicesProducts & Services
- SolutionsSolutions
- PricingPricing
- CompanyCompany
- ResourcesResources
en
en
A short verification protects source data and prevents automated AI requests.
Verifying...
As of 11/08/2026, withastro recorded 9 security vulnerabilities in the last 90 days across 1 products, including 1 rated High or above and 0 known exploited vulnerabilities (KEV) that should be prioritized for immediate remediation.
Over the last 90 days, astro had the most security vulnerabilities in the withastro ecosystem, with 9 vulnerabilities—approximately 100% of the provider's total vulnerabilities during this period.
CyStack VulnScan continuously discovers assets, validates vulnerabilities, and helps security teams prioritize remediation across the organization.
CVE-2026-114128Astro: Reflected/Stored XSS via unescaped <script>/<style> tag content in JSX/MDX renderingCVE-2026-114127Astro: Arbitrary CSS injection in Astro View TransitionsCVE-2026-102984Uncaught exception in the withastro Astro Node adapter can terminate the serverCVE-2026-102983Astro: Netlify Image CDN allowlist bypass enables SSRFCVE-2026-84376Astro: Authorization bypass from missing path-segment boundary check when stripping the configured base| Vulnerability | Exploitation status | Fix | Affected product | Published | Severity |
|---|---|---|---|---|---|
CVE-2026-114128Astro: Reflected/Stored XSS via unescaped <script>/<style> tag content in JSX/MDX rendering | Exploitation statusNot exploited | FixYes |
| Affected productastro |
| Published10/21/2026 |
| SeverityMedium |
CVE-2026-114127Astro: Arbitrary CSS injection in Astro View Transitions | Exploitation statusActively exploited | FixYes | Affected productastro | Published10/21/2026 | SeverityLow |
|---|
CVE-2026-102984Uncaught exception in the withastro Astro Node adapter can terminate the server | Exploitation statusNot exploited | FixYes | Affected productastro | Published09/30/2026 | SeverityHigh |
|---|
CVE-2026-102983Astro: Netlify Image CDN allowlist bypass enables SSRF | Exploitation statusNot exploited | FixYes | Affected productnetlify | Published09/30/2026 | SeverityMedium |
|---|
CVE-2026-84376Astro: Authorization bypass from missing path-segment boundary check when stripping the configured base | Exploitation statusNot exploited | FixYes | Affected productastro | Published09/02/2026 | SeverityMedium |
|---|
CVE-2026-73424Astro: Unauthenticated path override in the @astrojs/vercel ISR function | Exploitation statusActively exploited | FixYes | Affected productastro | Published08/17/2026 | SeverityMedium |
|---|
CVE-2026-73425@astrojs/netlify generates an overly-broad Netlify Image CDN allowlist because remotePatterns.pathname metacharacters are not escaped | Exploitation statusNot exploited | FixYes | Affected productastro | Published08/12/2026 | SeverityLow |
|---|
CVE-2026-73423Astro: composable `astro/hono` pipeline bypasses `security.checkOrigin` when `middleware()` is absent or misordered | Exploitation statusNot exploited | FixYes | Affected productastro | Published08/12/2026 | SeverityMedium |
|---|
CVE-2026-73422Astro: Reflected XSS via unescaped View Transition animation properties | Exploitation statusActively exploited | FixYes | Affected productastro | Published08/12/2026 | SeverityMedium |
|---|
CVE-2026-59730@astrojs/node: Backslash-prefixed paths not recognized as internal by trailing-slash redirect | Exploitation statusNot exploited | FixYes | Affected productastro | Published07/27/2026 | SeverityLow |
|---|
CVE-2026-59729Astro: XSS via unescaped spread attribute names in renderHTMLElement (incomplete fix for CVE-2026-54298) | Exploitation statusActively exploited | FixYes | Affected productastro | Published07/27/2026 | SeverityMedium |
|---|
CVE-2026-59728@astrojs/rss: XML Injection via Unescaped RSS Feed Fields | Exploitation statusActively exploited | FixYes | Affected productastro | Published07/27/2026 | SeverityMedium |
|---|
CVE-2026-59727Astro: Cross-site scripting via unescaped transition:* directive values on hydrated islands | Exploitation statusActively exploited | FixYes | Affected productastro | Published07/27/2026 | SeverityLow |
|---|
CVE-2026-59731Astro 6.4.7 Authorization Bypass via Decode Iteration Limit and Rewrite Path Canonicalization Mismatch | Exploitation statusActively exploited | FixYes | Affected productastro | Published07/08/2026 | SeverityHigh |
|---|
CVE-2026-54300@astrojs/netlify broadens Astro image.remotePatterns in Netlify Image CDN config | Exploitation statusActively exploited | FixYes | Affected productastro | Published06/22/2026 | SeverityMedium |
|---|
CVE-2026-54299Astro: Host-header full-read SSRF in core prerendered error-page fetch (prerenderedErrorPageFetch default + unvalidated createRequestFromNodeRequest URL) | Exploitation statusNot exploited | FixYes | Affected productastro | Published06/22/2026 | SeverityHigh |
|---|
CVE-2026-54298Astro: XSS via Unescaped Attribute Names in Spread Props | Exploitation statusActively exploited | FixYes | Affected productastro | Published06/22/2026 | SeverityMedium |
|---|
CVE-2026-50146Astro: Reflected XSS via unescaped slot name | Exploitation statusActively exploited | FixYes | Affected productastro | Published06/22/2026 | SeverityHigh |
|---|
CVE-2026-45028Astro: Server island encrypted parameters vulnerable to cross-component replay | Exploitation statusNot exploited | FixYes | Affected productastro | Published05/13/2026 | SeverityLow |
|---|
CVE-2026-41322@astrojs/node: Cache Poisoning due to incorrect error handling when if-match header is malformed | Exploitation statusActively exploited | FixYes | Affected productastro | Published04/24/2026 | SeverityMedium |
|---|
CVE-2026-41321@astrojs/cloudflare: SSRF via redirect following in Cloudflare image-binding-transform endpoint | Exploitation statusActively exploited | FixYes | Affected product@astrojs/cloudflare | Published04/24/2026 | SeverityLow |
|---|
CVE-2026-41067Astro: XSS via incomplete `</script>` sanitization in `define:vars` allows case-insensitive and whitespace-based bypass | Exploitation statusActively exploited | FixYes | Affected productastro | Published04/24/2026 | SeverityMedium |
|---|
CVE-2026-33769Astro: Remote allowlist bypass via unanchored matchPathname wildcard | Exploitation statusActively exploited | FixYes | Affected productastro | Published03/24/2026 | SeverityLow |
|---|
CVE-2026-33768Astro: Unauthenticated Path Override via `x-astro-path` / `x_astro_path` | Exploitation statusActively exploited | FixYes | Affected productastro | Published03/24/2026 | SeverityMedium |
|---|
CVE-2026-29772Astro: Memory exhaustion DoS due to missing request body size limit in Server Islands | Exploitation statusActively exploited | FixYes | Affected productastro | Published03/24/2026 | SeverityMedium |
|---|
CVE-2026-27829Astro is vulnerable to SSRF due to missing allowlist enforcement in remote image inferSize | Exploitation statusActively exploited | FixNo | Affected productastro | Published02/26/2026 | SeverityMedium |
|---|
CVE-2026-27729Astro has memory exhaustion DoS due to missing request body size limit in Server Actions | Exploitation statusActively exploited | FixNo | Affected productastro | Published02/24/2026 | SeverityMedium |
|---|
CVE-2026-25545Astro has Full-Read SSRF in error rendering via Host: header injection | Exploitation statusActively exploited | FixNo | Affected productastro | Published02/24/2026 | SeverityMedium |
|---|
CVE-2025-66202Astro has an Authentication Bypass via Double URL Encoding, a bypass for CVE-2025-64765 | Exploitation statusNot exploited | FixYes | Affected productastro | Published12/08/2025 | SeverityMedium |
|---|
CVE-2025-65019Astro Cloudflare adapter has a Stored Cross Site Scripting vulnerability in /_image endpoint | Exploitation statusActively exploited | FixYes | Affected productastro | Published11/19/2025 | SeverityMedium |
|---|
CVE-2025-64765Astro middleware authentication checks based on url.pathname can be bypassed via url encoded values | Exploitation statusNot exploited | FixYes | Affected productastro | Published11/19/2025 | SeverityMedium |
|---|
CVE-2025-64764Astro is vulnerable to Reflected XSS via the server islands feature | Exploitation statusActively exploited | FixYes | Affected productastro | Published11/19/2025 | SeverityHigh |
|---|
CVE-2025-64757Astro Development Server is Vulnerable to Arbitrary Local File Read | Exploitation statusActively exploited | FixYes | Affected productastro | Published11/19/2025 | SeverityLow |
|---|
CVE-2025-64745Astro development server error page vulnerable to reflected Cross-site Scripting | Exploitation statusActively exploited | FixNo | Affected productastro | Published11/13/2025 | SeverityLow |
|---|
CVE-2025-64525Astro: URL manipulation via unsanitized headers leads to path-based middleware protections bypass, potential SSRF/cache-poisoning, CVE-2025-61925 bypass | Exploitation statusActively exploited | FixNo | Affected productastro | Published11/13/2025 | SeverityMedium |
|---|
CVE-2025-59837astro allows bypass of image proxy domain validation leading to SSRF and potential XSS | Exploitation statusNot exploited | FixYes | Affected productastro | Published10/28/2025 | SeverityHigh |
|---|
CVE-2025-61925Astro's `X-Forwarded-Host` is reflected with no validation | Exploitation statusActively exploited | FixNo | Affected productastro | Published10/10/2025 | SeverityMedium |
|---|
CVE-2025-58179Astro Cloudflare adapter is vulnerable to Server-Side Request Forgery via /_image endpoint | Exploitation statusActively exploited | FixYes | Affected productastro | Published09/04/2025 | SeverityHigh |
|---|
CVE-2025-55303Unauthorized third-party images in Astro’s _image endpoint | Exploitation statusActively exploited | FixYes | Affected productastro | Published08/19/2025 | SeverityMedium |
|---|
CVE-2025-55207@astrojs/node's trailing slash handling causes open redirect issue | Exploitation statusActively exploited | FixYes | Affected productastro | Published08/15/2025 | SeverityMedium |
|---|
CVE-2025-54793Astro: Duplicate trailing slash feature can lead to Open Redirects | Exploitation statusActively exploited | FixYes | Affected productastro | Published08/08/2025 | SeverityMedium |
|---|
CVE-2024-56159Server source code is exposed to the public if sourcemaps are enabled | Exploitation statusActively exploited | FixNo | Affected productastro | Published12/19/2024 | SeverityHigh |
|---|
CVE-2024-56140Bypass of CSRF Middleware in Astro | Exploitation statusActively exploited | FixNo | Affected productastro | Published12/18/2024 | SeverityMedium |
|---|
CVE-2024-47885astro's client-side router has DOM Clobbering Gadget that leads to XSS | Exploitation statusActively exploited | FixNo | Affected productastro | Published10/14/2024 | SeverityMedium |
|---|
44 Results | Page 1 of 1