AS
Product
Astro
20
CVEs
0
On KEV
7.5
Max CVSS
0
New 30D
Severity mix
Critical 0High 2Medium 17Low 1
Watch
Add Astro to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-54299 | 7.5 | Jun 22 | Astro: Host-header full-read SSRF in core prerendered error-page fetch (prerenderedErrorPageFetch default + unvalidated createRequestFromNodeRequest URL) Affected: before 6.4.6 |
| CVE-2025-59837 | 7.2 | Oct 28 | Astro is a web framework that includes an image proxy Affected: 5.13.4 before 5.13.10 |
| CVE-2025-66202 | 6.5 | Dec 8 | Astro has an Authentication Bypass via Double URL Encoding, a bypass for CVE-2025-64765 Affected: before 5.15.8 |
| CVE-2025-64525 | 6.5 | Nov 13 | Astro is a web framework Affected: 2.16.0 before 5.15.5 |
| CVE-2025-61925 | 6.5 | Oct 10 | Astro is a web framework Affected: before 5.14.2 |
| CVE-2024-56140 | 6.5 | Dec 18 | Bypass of CSRF Middleware in Astro Affected: before 4.16.17 |
| CVE-2026-54298 | 6.1 | Jun 22 | Astro: XSS via Unescaped Attribute Names in Spread Props Affected: before 6.4.6 |
| CVE-2026-50146 | 6.1 | Jun 22 | Astro: Reflected XSS via unescaped slot name Affected: before 6.3.3 |
| CVE-2026-45028 | 6.1 | May 13 | Astro: Server island encrypted parameters vulnerable to cross-component replay Affected: before 6.1.10 |
| CVE-2026-41067 | 6.1 | Apr 24 | Astro: XSS via incomplete `</script>` sanitization in `define:vars` allows case-insensitive and whitespace-based bypass Affected: before 6.1.6 |
| CVE-2025-65019 | 6.1 | Nov 19 | Astro is a web framework Affected: before 5.15.9 |
| CVE-2025-64745 | 6.1 | Nov 13 | Astro is a web framework Affected: 5.2.0 before 5.15.6 |
| CVE-2025-55303 | 6.1 | Aug 19 | Astro is a web framework for content-driven websites Affected: before 4.16.18; 5.0.0 before 5.13.2 |
| CVE-2025-54793 | 6.1 | Aug 8 | Astro is a web framework for content-driven websites Affected: 5.2.0 before 5.12.7 |
| CVE-2025-64764 | 5.4 | Nov 19 | Astro is a web framework Affected: before 5.15.8 |
| CVE-2024-47885 | 5.4 | Oct 14 | The Astro web framework has a DOM Clobbering gadget in the client-side router starting in version 3.0.0 and prior to version 4.16.1 Affected: 3.0.0 before 4.16.1 |
| CVE-2026-33769 | 5.3 | Mar 24 | Astro: Remote allowlist bypass via unanchored matchPathname wildcard Affected: 2.10.10 before 5.18.1 |
| CVE-2025-64765 | 5.3 | Nov 19 | Astro is a web framework Affected: before 5.15.8 |
| CVE-2024-56159 | 5.3 | Dec 19 | Server source code is exposed to the public if sourcemaps are enabled Affected: before 4.16.18; 5.0.0 before 5.0.8 |
| CVE-2025-64757 | 3.5 | Nov 19 | Astro is a web framework Affected: before 5.14.3 |
Showing 20