withastro astro

• CVE-2026-114128 Medium 6.5 Astro: Reflected/Stored XSS via unescaped <script>/<style> tag content in JSX/MDX rendering 0.3%
• CVE-2026-114127 Low 2.3 Astro: Arbitrary CSS injection in Astro View Transitions 0.5%
• CVE-2026-102984 High 8.2 Astro: Malformed port in the Host header can crash the Node adapter 0.4%
• CVE-2026-102983 Medium 6.3 Astro: Netlify Image CDN allowlist bypass enables SSRF 0.3%
• CVE-2026-84376 Medium 6.3 Astro: Authorization bypass from missing path-segment boundary check when stripping the configured base 0.7%
• CVE-2026-73424 Medium 6.5 Astro: Unauthenticated path override in the @astrojs/vercel ISR function 0.4%
• CVE-2026-73425 Low 3.7 @astrojs/netlify generates an overly-broad Netlify Image CDN allowlist because remotePatterns.pathname metacharacters are not escaped 0.3%
• CVE-2026-73423 Medium 5.1 Astro: composable `astro/hono` pipeline bypasses `security.checkOrigin` when `middleware()` is absent or misordered 0.3%
• CVE-2026-73422 Medium 5.3 Astro: Reflected XSS via unescaped View Transition animation properties 0.5%
• CVE-2026-59730 Low 2.1 @astrojs/node: Backslash-prefixed paths not recognized as internal by trailing-slash redirect 0.5%
• CVE-2026-59728 Medium 4.3 @astrojs/rss: XML Injection via Unescaped RSS Feed Fields 0.3%
• CVE-2026-59727 Low 2.1 Astro: Cross-site scripting via unescaped transition:* directive values on hydrated islands 0.4%
• CVE-2026-59729 Medium 5.1 Astro: XSS via unescaped spread attribute names in renderHTMLElement (incomplete fix for CVE-2026-54298) 0.5%
• CVE-2026-59731 High 8.2 Astro 6.4.7 Authorization Bypass via Decode Iteration Limit and Rewrite Path Canonicalization Mismatch 0.3%
• CVE-2026-54299 High 7.5 Astro: Host-header full-read SSRF in core prerendered error-page fetch (prerenderedErrorPageFetch default + unvalidated createRequestFromNodeRequest URL) 0.3%
• CVE-2026-54298 Medium 4.2 Astro: XSS via Unescaped Attribute Names in Spread Props 0.2%
• CVE-2026-50146 High 7.1 Astro: Reflected XSS via unescaped slot name 0.3%
• CVE-2026-54300 Medium 5.3 @astrojs/netlify broadens Astro image.remotePatterns in Netlify Image CDN config 0.3%
• CVE-2026-45028 Low 2.9 Astro: Server island encrypted parameters vulnerable to cross-component replay 0.1%
• CVE-2026-41322 Medium 5.3 @astrojs/node: Cache Poisoning due to incorrect error handling when if-match header is malformed 0.3%
• CVE-2026-41067 Medium 6.1 Astro: XSS via incomplete `</script>` sanitization in `define:vars` allows case-insensitive and whitespace-based bypass 0.2%
• CVE-2026-33769 Low 2.9 Astro: Remote allowlist bypass via unanchored matchPathname wildcard 0.3%
• CVE-2026-33768 Medium 6.5 Astro: Unauthenticated Path Override via `x-astro-path` / `x_astro_path` 0.3%
• CVE-2026-29772 Medium 5.9 Astro: Memory exhaustion DoS due to missing request body size limit in Server Islands 0.4%
• CVE-2026-27829 Medium 6.5 Astro is vulnerable to SSRF due to missing allowlist enforcement in remote image inferSize 0.3%
• CVE-2026-27729 Medium 5.9 Astro has memory exhaustion DoS due to missing request body size limit in Server Actions 0.5%
• CVE-2026-25545 Medium 6.9 Astro has Full-Read SSRF in error rendering via Host: header injection 1.9%
• CVE-2025-66202 Medium 6.5 Astro has an Authentication Bypass via Double URL Encoding, a bypass for CVE-2025-64765 0.3%
• CVE-2025-64765 Medium 6.9 Astro middleware authentication checks based on url.pathname can be bypassed via url encoded values 0.5%
• CVE-2025-64764 High 7.1 Astro is vulnerable to Reflected XSS via the server islands feature 0.5%
• CVE-2025-65019 Medium 5.4 Astro Cloudflare adapter has a Stored Cross Site Scripting vulnerability in /_image endpoint 0.3%
• CVE-2025-64757 Low 3.5 Astro Development Server is Vulnerable to Arbitrary Local File Read 0.4%
• CVE-2025-64745 Low 2.7 Astro development server error page vulnerable to reflected Cross-site Scripting 0.3%
• CVE-2025-64525 Medium 6.5 Astro: URL manipulation via unsanitized headers leads to path-based middleware protections bypass, potential SSRF/cache-poisoning, CVE-2025-61925 bypass 1.2%
• CVE-2025-59837 High 7.2 astro allows bypass of image proxy domain validation leading to SSRF and potential XSS 0.4%
• CVE-2025-61925 Medium 6.5 Astro's `X-Forwarded-Host` is reflected with no validation 0.4%
• CVE-2025-58179 High 7.2 Astro Cloudflare adapter is vulnerable to Server-Side Request Forgery via /_image endpoint 0.9%
• CVE-2025-55303 Medium 6.9 Unauthorized third-party images in Astro’s _image endpoint 0.6%
• CVE-2025-55207 Medium 5.5 @astrojs/node's trailing slash handling causes open redirect issue 0.6%
• CVE-2025-54793 Medium 5.5 Astro: Duplicate trailing slash feature can lead to Open Redirects 0.7%
• CVE-2024-56159 High 7.8 Server source code is exposed to the public if sourcemaps are enabled 1.5%
• CVE-2024-56140 Medium 5.9 Bypass of CSRF Middleware in Astro 0.2%
• CVE-2024-47885 Medium 5.9 astro's client-side router has DOM Clobbering Gadget that leads to XSS 0.4%