Skip to content
OpenAdvisories

Package · npm

@astrojs/vercel

2 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

2 results · Feed

  • Medium 6.5
    CVE-2026-73424

    Astro: Unauthenticated path override in the @astrojs/vercel ISR function

    Astro is a web framework for content-driven websites. From 10.0.3 until 11.0.3, the Astro Vercel adapter in packages/integrations/vercel/src/serverless/entrypoint.ts accepts x_astro_path for the public /_isr function based only on the x-vercel-isr header, all…

    withastro astro @astrojs/vercel npm
  • Medium 6.5
    CVE-2026-33768

    Astro: Unauthenticated Path Override via `x-astro-path` / `x_astro_path`

    Astro is a web framework. Prior to version 10.0.2, the @astrojs/vercel serverless entrypoint reads the x-astro-path header and x_astro_path query parameter to rewrite the internal request path, with no authentication whatsoever. On deployments without Edge Mi…

    withastro astro @astrojs/vercel npm