Skip to content
OpenAdvisories

Vendor

withastro

44 known vulnerabilities.

Products

astro 43 @astrojs/cloudflare 1
All Critical High Medium Low Exploited only Public exploit

8 results · Clear filters · Feed

  • High 8.2
    CVE-2026-102984

    Astro: Malformed port in the Host header can crash the Node adapter

    Astro is a web framework for content-driven websites. Prior to 11.1.3, the @astrojs/node adapter builds a request URL from the Host header, and a malformed port can make that URL invalid. The recovery path reuses the same malformed host and throws an uncaught…

    withastro astro @astrojs/node npm
  • High 8.2
    CVE-2026-59731

    Astro 6.4.7 Authorization Bypass via Decode Iteration Limit and Rewrite Path Canonicalization Mismatch

    Astro is a web framework for content-driven websites. Version 6.4.7 performs authorization decisions on a partially decoded pathname after reaching the iterative URL decoder limit, while later rewrite route matching performs an additional decodeURI() operatio…

    withastro astro astro npm
  • High 7.5
    CVE-2026-54299

    Astro: Host-header full-read SSRF in core prerendered error-page fetch (prerenderedErrorPageFetch default + unvalidated createRequestFromNodeRequest URL)

    Astro is a web framework. Prior to 6.4.6, Astro SSR apps with prerendered error pages (/404 or /500 using export const prerender = true) fetch those pages over HTTP at runtime when an error occurs. The URL for this fetch is derived from request.url, which in …

    withastro astro astro npm
  • High 7.1
    CVE-2026-50146

    Astro: Reflected XSS via unescaped slot name

    Astro is a web framework. Prior to 6.3.3, when a component uses a client:* directive, Astro inserts named slot content into a data-astro-template attribute without HTML escaping the slot name allowing an attacker to break out of the attribute context and inje…

    withastro astro astro npm
  • High 7.1
    CVE-2025-64764 Scanner template

    Astro is vulnerable to Reflected XSS via the server islands feature

    Astro is a web framework. Prior to version 5.15.8, a reflected XSS vulnerability is present when the server islands feature is used in the targeted application, regardless of what was intended by the component template(s). This issue has been patched in versi…

    withastro astro astro npm
  • High 7.2
    CVE-2025-59837

    astro allows bypass of image proxy domain validation leading to SSRF and potential XSS

    Astro is a web framework that includes an image proxy. In versions 5.13.4 and later before 5.13.10, the image proxy domain validation can be bypassed by using backslashes in the href parameter, allowing server-side requests to arbitrary URLs. This can lead to…

    withastro astro astro npm
  • High 7.2
    CVE-2025-58179 Public exploit Scanner template

    Astro Cloudflare adapter is vulnerable to Server-Side Request Forgery via /_image endpoint

    Astro is a web framework for content-driven websites. Versions 11.0.3 through 12.6.5 are vulnerable to SSRF when using Astro's Cloudflare adapter. When configured with output: 'server' while using the default imageService: 'compile', the generated image optim…

    withastro astro @astrojs/cloudflare npm
  • High 7.8
    CVE-2024-56159 Scanner template

    Server source code is exposed to the public if sourcemaps are enabled

    Astro is a web framework for content-driven websites. A bug in the build process allows any unauthenticated user to read parts of the server source code. During build, along with client assets such as css and font files, the sourcemap files **for the server c…

    withastro astro astro npm