AS
Product
astro
29
CVEs
0
On KEV
9.1
Max CVSS
4
New 30D
Severity mix
Critical 1High 7Medium 17Low 4
Watch
Add astro to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-25545 | 8.6 | Feb 24 | Astro has Full-Read SSRF in error rendering via Host: header injection Affected: < 9.5.4 |
| CVE-2026-102984 | 8.2 | Sep 30 | Astro: Malformed port in the Host header can crash the Node adapter Affected: < 11.1.3 |
| CVE-2026-59731 | 8.2 | Jul 8 | Astro 6.4.7 Authorization Bypass via Decode Iteration Limit and Rewrite Path Canonicalization Mismatch Affected: >= 6.4.7, < 6.4.8 |
| CVE-2026-54299 | 7.5 | Jun 22 | Astro: Host-header full-read SSRF in core prerendered error-page fetch (prerenderedErrorPageFetch default + unvalidated createRequestFromNodeRequest URL) Affected: < 6.4.6 |
| CVE-2026-29772 | 7.5 | Mar 24 | Astro: Memory exhaustion DoS due to missing request body size limit in Server Islands Affected: < 10.0.0 |
| CVE-2026-27729 | 7.5 | Feb 24 | Astro has memory exhaustion DoS due to missing request body size limit in Server Actions Affected: >= 9.0.0, < 9.5.4 |
| CVE-2026-27829 | 7.2 | Feb 26 | Astro is vulnerable to SSRF due to missing allowlist enforcement in remote image inferSize Affected: >= 9.0.0, < 9.5.4 |
Showing 7