CVE-2026-73425 | Low | 3.7 | 2026-08-12 | Astro is a web framework for content-driven websites. Prior to 8.1.2, the Astro Netlify adapter converts each image.remotePatterns entry into a regular express… |
CVE-2026-73423 | | | 2026-08-12 | Astro is a web framework for content-driven websites. From 7.0.0 until 7.0.6, the composable astro/hono pipeline installs security.checkOrigin only through the… |
CVE-2026-73422 | | | 2026-08-12 | Astro is a web framework for content-driven websites. From 2.9.0 until 7.1.0, Astro's server-side View Transition CSS generator interpolates animation properti… |
CVE-2026-59730 | | | 2026-07-27 | Astro is a web framework for content-driven websites. In versions 8.1.0 through 11.0.1, when trailingSlash: 'always' is configured, the @astrojs/node standalon… |
CVE-2026-59728 | Medium | 4.3 | 2026-07-27 | Astro is a web framework for content-driven websites. In versions 1.0.0 through 4.0.18, the source.title and enclosure.type item fields in packages/astro-rss/s… |
CVE-2026-59729 | | | 2026-07-27 | Astro is a web framework for content-driven websites. Versions prior to 7.0.6 are vulnerable to XSS through unescaped spread attribute names in renderHTMLEleme… |
CVE-2026-59727 | | | 2026-07-27 | Astro is a web framework for content-driven websites. In versions 3.10.0 through 7.0.3, when a transition:persist, transition:scope, or transition:persist-prop… |
CVE-2026-59731 | High | 8.2 | 2026-07-08 | Astro is a web framework for content-driven websites. Version 6.4.7 performs authorization decisions on a partially decoded pathname after reaching the iterati… |
CVE-2026-54300 | Medium | 5.3 | 2026-06-22 | @astrojs/netlify is an adapter that allows Astro to deploy your hybrid or server rendered site to Netlify. Prior to 7.0.13, @astrojs/netlify converts Astro ima… |
CVE-2026-54299 | High | 7.5 | 2026-06-22 | Astro is a web framework. Prior to 6.4.6, Astro SSR apps with prerendered error pages (/404 or /500 using export const prerender = true) fetch those pages over… |
CVE-2026-54298 | Medium | 4.2 | 2026-06-22 | Astro is a web framework. Prior to 6.4.6, the spreadAttributes function in Astro's server-side rendering pipeline iterates over object keys and passes them dir… |
CVE-2026-50146 | High | 7.1 | 2026-06-22 | Astro is a web framework. Prior to 6.3.3, when a component uses a client:* directive, Astro inserts named slot content into a data-astro-template attribute wit… |
CVE-2026-45028 | Medium | 6.1 | 2026-05-13 | Astro is a web framework. Astro versions prior to 6.1.10 used AES-GCM encryption to protect the confidentiality and integrity of server island props and slots… |
CVE-2026-41322 | Medium | 5.3 | 2026-04-24 | @astrojs/node allows Astro to deploy your SSR site to Node targets. Prior to 10.0.5, requesting a static js/css resources from _astro path with an incorrect/ma… |
CVE-2026-41321 | Low | 2.2 | 2026-04-24 | @astrojs/cloudflare is an SSR adapter for use with Cloudflare Workers targets. Prior to 13.1.10, the fetch() call for remote images in packages/integrations/cl… |
CVE-2026-41067 | Medium | 6.1 | 2026-04-24 | Astro is a web framework. Prior to 6.1.6, the defineScriptVars function in Astro's server-side rendering pipeline uses a case-sensitive regex /<\/script>/g to… |
CVE-2026-33769 | Medium | 5.3 | 2026-03-24 | Astro is a web framework. From version 2.10.10 to before version 5.18.1, this issue concerns Astro's remotePatterns path enforcement for remote URLs used by se… |
CVE-2026-33768 | Medium | 6.5 | 2026-03-24 | Astro is a web framework. Prior to version 10.0.2, the @astrojs/vercel serverless entrypoint reads the x-astro-path header and x_astro_path query parameter to… |
CVE-2026-29772 | Medium | 5.9 | 2026-03-24 | Astro is a web framework. Prior to version 10.0.0, Astro's Server Islands POST handler buffers and parses the full request body as JSON without enforcing a siz… |
CVE-2026-27829 | Medium | 6.5 | 2026-02-26 | Astro is a web framework. In versions 9.0.0 through 9.5.3, a bug in Astro's image pipeline allows bypassing `image.domains` / `image.remotePatterns` restrictio… |
CVE-2026-27729 | Medium | 5.9 | 2026-02-24 | Astro is a web framework. In versions 9.0.0 through 9.5.3, Astro server actions have no default request body size limit, which can lead to memory exhaustion Do… |
CVE-2026-25545 | High | 8.6 | 2026-02-24 | Astro is a web framework. Prior to version 9.5.4, Server-Side Rendered pages that return an error with a prerendered custom error page (eg. `404.astro` or `500… |
CVE-2025-66202 | Medium | 6.5 | 2025-12-09 | Astro is a web framework. Versions 5.15.7 and below have a double URL encoding bypass which allows any unauthenticated attacker to bypass path-based authentica… |
CVE-2025-65019 | Medium | 5.4 | 2025-11-19 | Astro is a web framework. Prior to version 5.15.9, when using Astro's Cloudflare adapter (@astrojs/cloudflare) with output: 'server', the image optimization en… |
CVE-2025-64765 | Medium | 5.3 | 2025-11-19 | Astro is a web framework. Prior to version 5.15.8, a mismatch exists between how Astro normalizes request paths for routing/rendering and how the application’s… |
CVE-2025-64764 | High | 7.1 | 2025-11-19 | Astro is a web framework. Prior to version 5.15.8, a reflected XSS vulnerability is present when the server islands feature is used in the targeted application… |
CVE-2025-64757 | Low | 3.5 | 2025-11-19 | Astro is a web framework. Prior to version 5.14.3, a vulnerability has been identified in the Astro framework's development server that allows arbitrary local… |
CVE-2025-64745 | Low | 2.7 | 2025-11-13 | Astro is a web framework. Starting in version 5.2.0 and prior to version 5.15.6, a Reflected Cross-Site Scripting (XSS) vulnerability exists in Astro's develop… |
CVE-2025-64525 | Medium | 6.5 | 2025-11-13 | Astro is a web framework. In Astro versions 2.16.0 up to but excluding 5.15.5 which utilizeon-demand rendering, request headers `x-forwarded-proto` and `x-forw… |
CVE-2025-59837 | High | 7.2 | 2025-10-28 | Astro is a web framework that includes an image proxy. In versions 5.13.4 and later before 5.13.10, the image proxy domain validation can be bypassed by using… |
CVE-2025-61925 | Medium | 6.5 | 2025-10-10 | Astro is a web framework. Prior to version 5.14.2, Astro reflects the value in `X-Forwarded-Host` in output when using `Astro.url` without any validation. It i… |
CVE-2025-58179 | High | 7.2 | 2025-09-05 | Astro is a web framework for content-driven websites. Versions 11.0.3 through 12.6.5 are vulnerable to SSRF when using Astro's Cloudflare adapter. When configu… |
CVE-2025-55303 | Medium | 6.1 | 2025-08-19 | Astro is a web framework for content-driven websites. In versions of astro before 5.13.2 and 4.16.18, the image optimization endpoint in projects deployed with… |
CVE-2025-55207 | | | 2025-08-15 | Astro is a web framework for content-driven websites. Following CVE-2025-54793 there's still an Open Redirect vulnerability in a subset of Astro deployment sce… |
CVE-2025-54793 | Medium | 6.1 | 2025-08-08 | Astro is a web framework for content-driven websites. In versions 5.2.0 through 5.12.7, there is an Open Redirect vulnerability in the trailing slash redirecti… |
CVE-2024-56159 | Medium | 5.3 | 2024-12-19 | Astro is a web framework for content-driven websites. A bug in the build process allows any unauthenticated user to read parts of the server source code. Durin… |
CVE-2024-56140 | Medium | 5.9 | 2024-12-18 | Astro is a web framework for content-driven websites. In affected versions a bug in Astro’s CSRF-protection middleware allows requests to bypass CSRF checks. W… |
CVE-2024-47885 | Medium | 5.9 | 2024-10-14 | The Astro web framework has a DOM Clobbering gadget in the client-side router starting in version 3.0.0 and prior to version 4.16.1. It can lead to cross-site… |