Astro: Unauthenticated Path Override via `x-astro-path` / `x_astro_path`

Astro has Full-Read SSRF in error rendering via Host: header injection

Astro: Malformed port in the Host header can crash the Node adapter

Astro 6.4.7 Authorization Bypass via Decode Iteration Limit and Rewrite Path Canonicalization Mismatch

Astro: Host-header full-read SSRF in core prerendered error-page fetch (prerenderedErrorPageFetch default + unvalidated createRequestFromNodeRequest URL)

Astro: Memory exhaustion DoS due to missing request body size limit in Server Islands

Astro has memory exhaustion DoS due to missing request body size limit in Server Actions

Astro is vulnerable to SSRF due to missing allowlist enforcement in remote image inferSize

Astro: Reflected/Stored XSS via unescaped <script>/<style> tag content in JSX/MDX rendering

Astro: Unauthenticated path override in the @astrojs/vercel ISR function

Bypass of CSRF Middleware in Astro

Astro: Netlify Image CDN allowlist bypass enables SSRF

Astro: Authorization bypass from missing path-segment boundary check when stripping the configured base

Astro: XSS via Unescaped Attribute Names in Spread Props

Astro: Reflected XSS via unescaped slot name

Astro: Server island encrypted parameters vulnerable to cross-component replay

Astro: XSS via incomplete `</script>` sanitization in `define:vars` allows case-insensitive and whitespace-based bypass

Astro: Reflected XSS via unescaped View Transition animation properties

@astrojs/netlify broadens Astro image.remotePatterns in Netlify Image CDN config

@astrojs/node: Cache Poisoning due to incorrect error handling when if-match header is malformed

Astro: Remote allowlist bypass via unanchored matchPathname wildcard

Server source code is exposed to the public if sourcemaps are enabled

Astro: composable `astro/hono` pipeline bypasses `security.checkOrigin` when `middleware()` is absent or misordered

Astro: XSS via unescaped spread attribute names in renderHTMLElement (incomplete fix for CVE-2026-54298)

@astrojs/rss: XML Injection via Unescaped RSS Feed Fields

@astrojs/netlify generates an overly-broad Netlify Image CDN allowlist because remotePatterns.pathname metacharacters are not escaped

Astro: Arbitrary CSS injection in Astro View Transitions

@astrojs/node: Backslash-prefixed paths not recognized as internal by trailing-slash redirect

Astro: Cross-site scripting via unescaped transition:* directive values on hydrated islands