Astro Astro
20 CVEs affecting Astro Astro. Latest disclosed: 2026-06-22. Critical: 0, High: 4.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-54299 | High | 7.5 | 2026-06-22 | Astro is a web framework. Prior to 6.4.6, Astro SSR apps with prerendered error pages (/404 or /500 using export const prerender = true) fetch those pages over… |
CVE-2025-59837 | High | 7.2 | 2025-10-28 | Astro is a web framework that includes an image proxy. In versions 5.13.4 and later before 5.13.10, the image proxy domain validation can be bypassed by using… |
CVE-2026-50146 | High | 7.1 | 2026-06-22 | Astro is a web framework. Prior to 6.3.3, when a component uses a client:* directive, Astro inserts named slot content into a data-astro-template attribute wit… |
CVE-2025-64764 | High | 7.1 | 2025-11-19 | Astro is a web framework. Prior to version 5.15.8, a reflected XSS vulnerability is present when the server islands feature is used in the targeted application… |
CVE-2025-66202 | Medium | 6.5 | 2025-12-09 | Astro is a web framework. Versions 5.15.7 and below have a double URL encoding bypass which allows any unauthenticated attacker to bypass path-based authentica… |
CVE-2025-64525 | Medium | 6.5 | 2025-11-13 | Astro is a web framework. In Astro versions 2.16.0 up to but excluding 5.15.5 which utilizeon-demand rendering, request headers `x-forwarded-proto` and `x-forw… |
CVE-2025-61925 | Medium | 6.5 | 2025-10-10 | Astro is a web framework. Prior to version 5.14.2, Astro reflects the value in `X-Forwarded-Host` in output when using `Astro.url` without any validation. It i… |
CVE-2026-45028 | Medium | 6.1 | 2026-05-13 | Astro is a web framework. Astro versions prior to 6.1.10 used AES-GCM encryption to protect the confidentiality and integrity of server island props and slots… |
CVE-2026-41067 | Medium | 6.1 | 2026-04-24 | Astro is a web framework. Prior to 6.1.6, the defineScriptVars function in Astro's server-side rendering pipeline uses a case-sensitive regex /<\/script>/g to… |
CVE-2025-55303 | Medium | 6.1 | 2025-08-19 | Astro is a web framework for content-driven websites. In versions of astro before 5.13.2 and 4.16.18, the image optimization endpoint in projects deployed with… |
CVE-2025-54793 | Medium | 6.1 | 2025-08-08 | Astro is a web framework for content-driven websites. In versions 5.2.0 through 5.12.7, there is an Open Redirect vulnerability in the trailing slash redirecti… |
CVE-2024-56140 | Medium | 5.9 | 2024-12-18 | Astro is a web framework for content-driven websites. In affected versions a bug in Astro’s CSRF-protection middleware allows requests to bypass CSRF checks. W… |
CVE-2024-47885 | Medium | 5.9 | 2024-10-14 | The Astro web framework has a DOM Clobbering gadget in the client-side router starting in version 3.0.0 and prior to version 4.16.1. It can lead to cross-site… |
CVE-2025-65019 | Medium | 5.4 | 2025-11-19 | Astro is a web framework. Prior to version 5.15.9, when using Astro's Cloudflare adapter (@astrojs/cloudflare) with output: 'server', the image optimization en… |
CVE-2026-33769 | Medium | 5.3 | 2026-03-24 | Astro is a web framework. From version 2.10.10 to before version 5.18.1, this issue concerns Astro's remotePatterns path enforcement for remote URLs used by se… |
CVE-2025-64765 | Medium | 5.3 | 2025-11-19 | Astro is a web framework. Prior to version 5.15.8, a mismatch exists between how Astro normalizes request paths for routing/rendering and how the application’s… |
CVE-2024-56159 | Medium | 5.3 | 2024-12-19 | Astro is a web framework for content-driven websites. A bug in the build process allows any unauthenticated user to read parts of the server source code. Durin… |
CVE-2026-54298 | Medium | 4.2 | 2026-06-22 | Astro is a web framework. Prior to 6.4.6, the spreadAttributes function in Astro's server-side rendering pipeline iterates over object keys and passes them dir… |
CVE-2025-64757 | Low | 3.5 | 2025-11-19 | Astro is a web framework. Prior to version 5.14.3, a vulnerability has been identified in the Astro framework's development server that allows arbitrary local… |
CVE-2025-64745 | Low | 2.7 | 2025-11-13 | Astro is a web framework. Starting in version 5.2.0 and prior to version 5.15.6, a Reflected Cross-Site Scripting (XSS) vulnerability exists in Astro's develop… |