Login Request a demo
AS
Product
astro
by withastro · last CVE Oct 21, 2026
42
CVEs
0
On KEV
9.1
Max CVSS
4
New 30D
Vulnerabilities42In the news0Timeline
Severity mix
Critical 1High 8Medium 28Low 5
Severity
All severities42Critical1High8Medium28Low5
Exploitation
On CISA KEV0Exploited in the wild0
Watch

Add astro to your stack to get only the CVEs that touch what you run.

CVECVSSEPSSPublishedSummary · affected versions
CVE-2026-73425
3.7
0%
Aug 12
@astrojs/netlify generates an overly-broad Netlify Image CDN allowlist because remotePatterns.pathname metacharacters are not escaped
Affected: < 8.1.2
CVE-2025-64757
3.5
0%
Nov 19
Astro Development Server is Vulnerable to Arbitrary Local File Read
Affected: < 5.14.3
CVE-2026-114127
2.3
0%
Oct 21
Astro: Arbitrary CSS injection in Astro View Transitions
Affected: >= 7.1.0, < 7.3.3
CVE-2026-59730
2.1
0%
Jul 27
@astrojs/node: Backslash-prefixed paths not recognized as internal by trailing-slash redirect
Affected: >= 8.1.0, < 11.0.2
CVE-2026-59727
2.1
0%
Jul 27
Astro: Cross-site scripting via unescaped transition:* directive values on hydrated islands
Affected: >= 3.10.0, < 7.0.4
Showing 5