AS
Vendor
Astro
26
CVEs
0
On KEV
0
New 30D
Products
AS7.5
Astro
Astro
20 CVEs0 on KEV0 new
AS8.6
@astrojs/node
Astro
4 CVEs0 on KEV0 new
AS6.5
@astrojs/cloudflare
Astro
1 CVEs0 on KEV0 new
AS9.1
@astrojs/vercel
Astro
1 CVEs0 on KEV0 new
Recent CVEs
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2026-54299 | AS Astro Astro | 7.5 | Jun 22 | Astro: Host-header full-read SSRF in core prerendered error-page fetch (prerenderedErrorPageFetch default + unvalidated createRequestFromNodeRequest URL) |
| CVE-2026-54298 | AS Astro Astro | 6.1 | Jun 22 | Astro: XSS via Unescaped Attribute Names in Spread Props |
| CVE-2026-50146 | AS Astro Astro | 6.1 | Jun 22 | Astro: Reflected XSS via unescaped slot name |
| CVE-2026-45028 | AS Astro Astro | 6.1 | May 13 | Astro: Server island encrypted parameters vulnerable to cross-component replay |
| CVE-2026-41067 | AS Astro Astro | 6.1 | Apr 24 | Astro: XSS via incomplete `</script>` sanitization in `define:vars` allows case-insensitive and whitespace-based bypass |
| CVE-2026-33769 | AS Astro Astro | 5.3 | Mar 24 | Astro: Remote allowlist bypass via unanchored matchPathname wildcard |
| CVE-2026-33768 | AS @astrojs/vercel Astro | 9.1 | Mar 24 | Astro: Unauthenticated Path Override via `x-astro-path` / `x_astro_path` |
| CVE-2026-29772 | AS @astrojs/node Astro | 7.5 | Mar 24 | Astro: Memory exhaustion DoS due to missing request body size limit in Server Islands |
| CVE-2026-27829 | AS @astrojs/node Astro | 7.2 | Feb 26 | Astro is vulnerable to SSRF due to missing allowlist enforcement in remote image inferSize |
| CVE-2026-27729 | AS @astrojs/node Astro | 7.5 | Feb 24 | Astro has memory exhaustion DoS due to missing request body size limit in Server Actions |
| CVE-2026-25545 | AS @astrojs/node Astro | 8.6 | Feb 24 | Astro has Full-Read SSRF in error rendering via Host: header injection |
| CVE-2025-66202 | AS Astro Astro | 6.5 | Dec 9 | Astro is a web framework |
| CVE-2025-65019 | AS Astro Astro | 6.1 | Nov 19 | Astro is a web framework |
| CVE-2025-64765 | AS Astro Astro | 5.3 | Nov 19 | Astro is a web framework |
| CVE-2025-64764 | AS Astro Astro | 5.4 | Nov 19 | Astro is a web framework |
| CVE-2025-64757 | AS Astro Astro | 3.5 | Nov 19 | Astro is a web framework |
| CVE-2025-64745 | AS Astro Astro | 6.1 | Nov 13 | Astro is a web framework |
| CVE-2025-64525 | AS Astro Astro | 6.5 | Nov 13 | Astro is a web framework |
| CVE-2025-59837 | AS Astro Astro | 7.2 | Oct 28 | Astro is a web framework that includes an image proxy |
| CVE-2025-61925 | AS Astro Astro | 6.5 | Oct 10 | Astro is a web framework |
| CVE-2025-58179 | AS @astrojs/cloudflare Astro | 6.5 | Sep 5 | Astro is a web framework for content-driven websites |
| CVE-2025-55303 | AS Astro Astro | 6.1 | Aug 19 | Astro is a web framework for content-driven websites |
| CVE-2025-54793 | AS Astro Astro | 6.1 | Aug 8 | Astro is a web framework for content-driven websites |
| CVE-2024-56159 | AS Astro Astro | 5.3 | Dec 19 | Server source code is exposed to the public if sourcemaps are enabled |
| CVE-2024-56140 | AS Astro Astro | 6.5 | Dec 18 | Bypass of CSRF Middleware in Astro |
| CVE-2024-47885 | AS Astro Astro | 5.4 | Oct 14 | The Astro web framework has a DOM Clobbering gadget in the client-side router starting in version 3.0.0 and prior to version 4.16.1 |