astro
- Software type
- Web framework
- Total vulnerabilities (90 days)
- Products & ServicesProducts & Services
- SolutionsSolutions
- PricingPricing
- CompanyCompany
- ResourcesResources
en
en
As of 11/08/2026, astro recorded 9 security vulnerabilities in the last 90 days, of which 1 is rated High or Critical. None of these vulnerabilities is actively exploited (KEV) according to CISA's catalog. CyStack recommends that organizations and individual users apply patches as soon as possible.
CyStack does not yet have sufficient official-source data to identify the latest version of astro and determine which vulnerabilities affect that version.
CyStack VulnScan continuously discovers assets, validates vulnerabilities, and helps security teams prioritize remediation across the organization.
CVE-2026-114128Astro: Reflected/Stored XSS via unescaped <script>/<style> tag content in JSX/MDX renderingCVE-2026-114127Astro: Arbitrary CSS injection in Astro View TransitionsCVE-2026-102984Uncaught exception in the withastro Astro Node adapter can terminate the serverCVE-2026-102983Astro: Netlify Image CDN allowlist bypass enables SSRFCVE-2026-84376Astro: Authorization bypass from missing path-segment boundary check when stripping the configured base| Vulnerability | Exploitation status | Fix | Published | Severity |
|---|---|---|---|---|
CVE-2026-114128Astro: Reflected/Stored XSS via unescaped <script>/<style> tag content in JSX/MDX rendering | Exploitation statusNot exploited | FixYes |
| SeverityMedium |
CVE-2026-114127Astro: Arbitrary CSS injection in Astro View Transitions | Exploitation statusActively exploited | FixYes | Published10/21/2026 | SeverityLow |
|---|
CVE-2026-102984Uncaught exception in the withastro Astro Node adapter can terminate the server | Exploitation statusNot exploited | FixYes | Published09/30/2026 | SeverityHigh |
|---|
CVE-2026-102983Astro: Netlify Image CDN allowlist bypass enables SSRF | Exploitation statusNot exploited | FixYes | Published09/30/2026 | SeverityMedium |
|---|
CVE-2026-84376Astro: Authorization bypass from missing path-segment boundary check when stripping the configured base | Exploitation statusNot exploited | FixYes | Published09/02/2026 | SeverityMedium |
|---|
CVE-2026-73424Astro: Unauthenticated path override in the @astrojs/vercel ISR function | Exploitation statusActively exploited | FixYes | Published08/17/2026 | SeverityMedium |
|---|
CVE-2026-73425@astrojs/netlify generates an overly-broad Netlify Image CDN allowlist because remotePatterns.pathname metacharacters are not escaped | Exploitation statusNot exploited | FixYes | Published08/12/2026 | SeverityLow |
|---|
CVE-2026-73423Astro: composable `astro/hono` pipeline bypasses `security.checkOrigin` when `middleware()` is absent or misordered | Exploitation statusNot exploited | FixYes | Published08/12/2026 | SeverityMedium |
|---|
CVE-2026-73422Astro: Reflected XSS via unescaped View Transition animation properties | Exploitation statusActively exploited | FixYes | Published08/12/2026 | SeverityMedium |
|---|
CVE-2026-59730@astrojs/node: Backslash-prefixed paths not recognized as internal by trailing-slash redirect | Exploitation statusNot exploited | FixYes | Published07/27/2026 | SeverityLow |
|---|
CVE-2026-59729Astro: XSS via unescaped spread attribute names in renderHTMLElement (incomplete fix for CVE-2026-54298) | Exploitation statusActively exploited | FixYes | Published07/27/2026 | SeverityMedium |
|---|
CVE-2026-59728@astrojs/rss: XML Injection via Unescaped RSS Feed Fields | Exploitation statusActively exploited | FixYes | Published07/27/2026 | SeverityMedium |
|---|
CVE-2026-59727Astro: Cross-site scripting via unescaped transition:* directive values on hydrated islands | Exploitation statusActively exploited | FixYes | Published07/27/2026 | SeverityLow |
|---|
CVE-2026-59731Astro 6.4.7 Authorization Bypass via Decode Iteration Limit and Rewrite Path Canonicalization Mismatch | Exploitation statusActively exploited | FixYes | Published07/08/2026 | SeverityHigh |
|---|
CVE-2026-54300@astrojs/netlify broadens Astro image.remotePatterns in Netlify Image CDN config | Exploitation statusActively exploited | FixYes | Published06/22/2026 | SeverityMedium |
|---|
CVE-2026-54299Astro: Host-header full-read SSRF in core prerendered error-page fetch (prerenderedErrorPageFetch default + unvalidated createRequestFromNodeRequest URL) | Exploitation statusNot exploited | FixYes | Published06/22/2026 | SeverityHigh |
|---|
CVE-2026-54298Astro: XSS via Unescaped Attribute Names in Spread Props | Exploitation statusActively exploited | FixYes | Published06/22/2026 | SeverityMedium |
|---|
CVE-2026-50146Astro: Reflected XSS via unescaped slot name | Exploitation statusActively exploited | FixYes | Published06/22/2026 | SeverityHigh |
|---|
CVE-2026-45028Astro: Server island encrypted parameters vulnerable to cross-component replay | Exploitation statusNot exploited | FixYes | Published05/13/2026 | SeverityLow |
|---|
CVE-2026-41322@astrojs/node: Cache Poisoning due to incorrect error handling when if-match header is malformed | Exploitation statusActively exploited | FixYes | Published04/24/2026 | SeverityMedium |
|---|
CVE-2026-41067Astro: XSS via incomplete `</script>` sanitization in `define:vars` allows case-insensitive and whitespace-based bypass | Exploitation statusActively exploited | FixYes | Published04/24/2026 | SeverityMedium |
|---|
CVE-2026-33769Astro: Remote allowlist bypass via unanchored matchPathname wildcard | Exploitation statusActively exploited | FixYes | Published03/24/2026 | SeverityLow |
|---|
CVE-2026-33768Astro: Unauthenticated Path Override via `x-astro-path` / `x_astro_path` | Exploitation statusActively exploited | FixYes | Published03/24/2026 | SeverityMedium |
|---|
CVE-2026-29772Astro: Memory exhaustion DoS due to missing request body size limit in Server Islands | Exploitation statusActively exploited | FixYes | Published03/24/2026 | SeverityMedium |
|---|
CVE-2026-27829Astro is vulnerable to SSRF due to missing allowlist enforcement in remote image inferSize | Exploitation statusActively exploited | FixNo | Published02/26/2026 | SeverityMedium |
|---|
CVE-2026-27729Astro has memory exhaustion DoS due to missing request body size limit in Server Actions | Exploitation statusActively exploited | FixNo | Published02/24/2026 | SeverityMedium |
|---|
CVE-2026-25545Astro has Full-Read SSRF in error rendering via Host: header injection | Exploitation statusActively exploited | FixNo | Published02/24/2026 | SeverityMedium |
|---|
CVE-2025-66202Astro has an Authentication Bypass via Double URL Encoding, a bypass for CVE-2025-64765 | Exploitation statusNot exploited | FixYes | Published12/08/2025 | SeverityMedium |
|---|
CVE-2025-65019Astro Cloudflare adapter has a Stored Cross Site Scripting vulnerability in /_image endpoint | Exploitation statusActively exploited | FixYes | Published11/19/2025 | SeverityMedium |
|---|
CVE-2025-64765Astro middleware authentication checks based on url.pathname can be bypassed via url encoded values | Exploitation statusNot exploited | FixYes | Published11/19/2025 | SeverityMedium |
|---|
CVE-2025-64764Astro is vulnerable to Reflected XSS via the server islands feature | Exploitation statusActively exploited | FixYes | Published11/19/2025 | SeverityHigh |
|---|
CVE-2025-64757Astro Development Server is Vulnerable to Arbitrary Local File Read | Exploitation statusActively exploited | FixYes | Published11/19/2025 | SeverityLow |
|---|
CVE-2025-64745Astro development server error page vulnerable to reflected Cross-site Scripting | Exploitation statusActively exploited | FixNo | Published11/13/2025 | SeverityLow |
|---|
CVE-2025-64525Astro: URL manipulation via unsanitized headers leads to path-based middleware protections bypass, potential SSRF/cache-poisoning, CVE-2025-61925 bypass | Exploitation statusActively exploited | FixNo | Published11/13/2025 | SeverityMedium |
|---|
CVE-2025-59837astro allows bypass of image proxy domain validation leading to SSRF and potential XSS | Exploitation statusNot exploited | FixYes | Published10/28/2025 | SeverityHigh |
|---|
CVE-2025-61925Astro's `X-Forwarded-Host` is reflected with no validation | Exploitation statusActively exploited | FixNo | Published10/10/2025 | SeverityMedium |
|---|
CVE-2025-58179Astro Cloudflare adapter is vulnerable to Server-Side Request Forgery via /_image endpoint | Exploitation statusActively exploited | FixYes | Published09/04/2025 | SeverityHigh |
|---|
CVE-2025-55303Unauthorized third-party images in Astro’s _image endpoint | Exploitation statusActively exploited | FixYes | Published08/19/2025 | SeverityMedium |
|---|
CVE-2025-55207@astrojs/node's trailing slash handling causes open redirect issue | Exploitation statusActively exploited | FixYes | Published08/15/2025 | SeverityMedium |
|---|
CVE-2025-54793Astro: Duplicate trailing slash feature can lead to Open Redirects | Exploitation statusActively exploited | FixYes | Published08/08/2025 | SeverityMedium |
|---|
CVE-2024-56159Server source code is exposed to the public if sourcemaps are enabled | Exploitation statusActively exploited | FixNo | Published12/19/2024 | SeverityHigh |
|---|
CVE-2024-56140Bypass of CSRF Middleware in Astro | Exploitation statusActively exploited | FixNo | Published12/18/2024 | SeverityMedium |
|---|
CVE-2024-47885astro's client-side router has DOM Clobbering Gadget that leads to XSS | Exploitation statusActively exploited | FixNo | Published10/14/2024 | SeverityMedium |
|---|
43 Results | Page 1 of 1