npmPackage

astro

28 known vulnerabilities (6 high, 16 medium, 6 low), with the versions each affects and the releases that fix them.

Latest release: 7.4.7 (Nov 5, 2026): no advisory affects it
Newest unaffected release: 7.4.7 (Nov 5, 2026), the latest release
Advisories: 28 · 6 high, 16 medium, 6 low

Weekly downloads: 10.8M
Dependents: 158
Releases: 500+ since 4.6.1 (Apr 12, 2024)
Registry: npm
Releases read: Nov 8, 2026

Version timeline

CVE-2026-114128
Affects 0.0.0-actions-20240425172525 to 7.3.1 (7.3.2 is outside it)
CVE-2026-114127
Affects 7.1.0 to 7.3.2 (7.3.3 is outside it)
CVE-2026-84376
Affects 0.0.0-actions-20240425172525 to 7.2.3 (7.2.4 is outside it)
CVE-2026-73423
Affects 7.0.0 to 7.0.5 (7.0.6 is outside it)
CVE-2026-73422
Affects 4.6.1 to 7.0.9 (7.1.0 is outside it)
CVE-2026-59727
Affects 4.6.1 to 7.0.3 (7.0.4 is outside it)
CVE-2026-59729
Affects 0.0.0-actions-20240425172525 to 7.0.5 (7.0.6 is outside it)
CVE-2026-59731
Affects 6.4.7 (6.4.8 is outside it)
CVE-2026-54299
Affects 0.0.0-actions-20240425172525 to 6.4.5 (6.4.6 is outside it)
CVE-2026-54298
Affects 0.0.0-actions-20240425172525 to 6.4.5 (6.4.6 is outside it)
CVE-2026-50146
Affects 0.0.0-actions-20240425172525 to 6.3.2 (6.3.3 is outside it)
CVE-2026-45028
Affects 0.0.0-actions-20240425172525 to 6.1.9 (6.1.10 is outside it)

Show all 28 advisoriesShow fewer advisories

CVE-2026-41067
Affects 0.0.0-actions-20240425172525 to 6.1.5 (6.1.6 is outside it)
CVE-2026-33769
Affects 4.6.1 to 5.18.0 (5.18.1 is outside it)
CVE-2025-66202
Affects 0.0.0-actions-20240425172525 to 5.15.7 (5.15.8 is outside it)
CVE-2025-64765
Affects 0.0.0-actions-20240425172525 to 5.15.7 (5.15.8 is outside it)
CVE-2025-64764
Affects 0.0.0-actions-20240425172525 to 5.15.7 (5.15.8 is outside it)
CVE-2025-65019
Affects 0.0.0-actions-20240425172525 to 5.15.8 (5.15.9 is outside it)
CVE-2025-64757
Affects 0.0.0-actions-20240425172525 to 5.14.1 (5.14.3 is outside it)
CVE-2025-64745
Affects 5.2.0 to 5.15.5 (5.15.6 is outside it)
CVE-2025-64525
Affects 4.6.1 to 5.15.4 (5.15.5 is outside it)
CVE-2025-59837
Affects 5.13.4 to 5.13.9 (5.13.10 is outside it)
CVE-2025-61925
Affects 0.0.0-actions-20240425172525 to 5.14.1 (5.14.3 is outside it)
CVE-2025-55303
Affects 0.0.0-actions-20240425172525 to 4.16.18 (4.16.19 is outside it); 5.0.0-alpha.0 to 5.13.1 (5.13.2 is outside it)
CVE-2025-54793
Affects 5.2.0 to 5.12.7 (5.12.8 is outside it)
CVE-2024-56159
Affects 0.0.0-actions-20240425172525 to 4.16.17 (4.16.18 is outside it); 5.0.0-alpha.0 to 5.0.7 (5.0.8 is outside it)
CVE-2024-56140
Affects 0.0.0-actions-20240425172525 to 4.16.16 (4.16.17 is outside it)
CVE-2024-47885
Affects 4.6.1 to 4.16.0 (4.16.1 is outside it)

Every release cve.now has on record, lowest version on the left; each bar is a run of versions an advisory affects. Older releases aren't stored, so the earliest spans may start sooner.

Advisories 28

CVE-2026-114128Medium 6.5
Astro: Reflected/Stored XSS via unescaped <script>/<style> tag content in JSX/MDX rendering
Affected: fixed in 7.3.2.
Fixed in 7.3.2 (released Sep 8, 2026, 43 days before disclosure).
The latest release, 7.4.7, is not affected.
40% of astro downloads last week were affected versions (4.7M).
CVE-2026-114127Low 2.3
Astro: Arbitrary CSS injection in Astro View Transitions
Affected: from 7.1.0, fixed in 7.3.3.
Fixed in 7.3.3 (released Sep 16, 2026, 35 days before disclosure).
The latest release, 7.4.7, is not affected.
11% of astro downloads last week were affected versions (1.3M).
CVE-2026-84376Medium 6.3
Astro: Authorization bypass from missing path-segment boundary check when stripping the configured base
Affected: fixed in 7.2.4.
Fixed in 7.2.4 (released Aug 19, 2026, 14 days before disclosure).
The latest release, 7.4.7, is not affected.
35% of astro downloads last week were affected versions (4.2M).
CVE-2026-73423Medium 5.1
Astro: composable `astro/hono` pipeline bypasses `security.checkOrigin` when `middleware()` is absent or misordered
Affected: from 7.0.0, fixed in 7.0.6.
Fixed in 7.0.6 (released Jul 2, 2026, 41 days before disclosure).
The latest release, 7.4.7, is not affected.
0.6% of astro downloads last week were affected versions (73.6K).
CVE-2026-73422Medium 5.3
Astro: Reflected XSS via unescaped View Transition animation properties
Affected: from 2.9.0, fixed in 7.1.0.
Fixed in 7.1.0 (released Jul 16, 2026, 27 days before disclosure).
The latest release, 7.4.7, is not affected.
31% of astro downloads last week were affected versions (3.6M).
CVE-2026-59727Low 2.1
Astro: Cross-site scripting via unescaped transition: directive values on hydrated islands
Affected: from 3.10.0, fixed in 7.0.4.
Fixed in 7.0.4 (released Jun 30, 2026, 27 days before disclosure).
The latest release, 7.4.7, is not affected.
28% of astro downloads last week were affected versions (3.3M).
CVE-2026-59729Medium 5.1
Astro: XSS via unescaped spread attribute names in renderHTMLElement (incomplete fix for CVE-2026-54298)
Affected: fixed in 7.0.6.
Fixed in 7.0.6 (released Jul 2, 2026, 25 days before disclosure).
The latest release, 7.4.7, is not affected.
28% of astro downloads last week were affected versions (3.3M).
CVE-2026-59731High 8.2
Astro 6.4.7 Authorization Bypass via Decode Iteration Limit and Rewrite Path Canonicalization Mismatch
Affected: from 6.4.7, fixed in 6.4.8.
Fixed in 6.4.8 (released Jun 17, 2026, 21 days before disclosure).
The latest release, 7.4.7, is not affected.
0.1% of astro downloads last week were affected versions (16.9K).
CVE-2026-54299High 7.5
Astro: Host-header full-read SSRF in core prerendered error-page fetch (prerenderedErrorPageFetch default + unvalidated…
Affected: fixed in 6.4.6.
Fixed in 6.4.6 (released Jun 10, 2026, 12 days before disclosure).
The latest release, 7.4.7, is not affected.
23% of astro downloads last week were affected versions (2.7M).
CVE-2026-54298Medium 4.2
Astro: XSS via Unescaped Attribute Names in Spread Props
Affected: fixed in 6.4.6.
Fixed in 6.4.6 (released Jun 10, 2026, 12 days before disclosure).
The latest release, 7.4.7, is not affected.
23% of astro downloads last week were affected versions (2.7M).
CVE-2026-50146High 7.1
Astro: Reflected XSS via unescaped slot name
Affected: fixed in 6.3.3.
Fixed in 6.3.3 (released May 14, 2026, 39 days before disclosure).
The latest release, 7.4.7, is not affected.
22% of astro downloads last week were affected versions (2.6M).
CVE-2026-45028Low 2.9
Astro: Server island encrypted parameters vulnerable to cross-component replay
Affected: fixed in 6.1.10.
Fixed in 6.1.10 (released Apr 28, 2026, 15 days before disclosure).
The latest release, 7.4.7, is not affected.
21% of astro downloads last week were affected versions (2.5M).
CVE-2026-41067Medium 6.1
Astro: XSS via incomplete `</script>` sanitization in `define:vars` allows case-insensitive and whitespace-based bypass
Affected: fixed in 6.1.6.
Fixed in 6.1.6 (released Apr 13, 2026, 11 days before disclosure).
The latest release, 7.4.7, is not affected.
20% of astro downloads last week were affected versions (2.4M).
CVE-2026-33769Low 2.9
Astro: Remote allowlist bypass via unanchored matchPathname wildcard
Affected: from 2.10.10, fixed in 5.18.1.
Fixed in 5.18.1 (released Mar 10, 2026, 14 days before disclosure).
The latest release, 7.4.7, is not affected.
7.7% of astro downloads last week were affected versions (917.1K).
CVE-2025-66202Medium 6.5
Astro has an Authentication Bypass via Double URL Encoding, a bypass for CVE-2025-64765
Affected: fixed in 5.15.8.
Fixed in 5.15.8 (released Nov 15, 2025, 23 days before disclosure).
The latest release, 7.4.7, is not affected.
6.3% of astro downloads last week were affected versions (740K).

Show all 28 advisoriesShow fewer advisories

CVE-2025-64765Medium 6.9
Astro middleware authentication checks based on url.pathname can be bypassed via url encoded values
Affected: fixed in 5.15.8.
Fixed in 5.15.8 (released Nov 15, 2025, 4 days before disclosure).
The latest release, 7.4.7, is not affected.
6.3% of astro downloads last week were affected versions (740K).
CVE-2025-64764High 7.1
Astro is vulnerable to Reflected XSS via the server islands feature
Affected: fixed in 5.15.8.
Fixed in 5.15.8 (released Nov 15, 2025, 4 days before disclosure).
The latest release, 7.4.7, is not affected.
6.3% of astro downloads last week were affected versions (740K).
CVE-2025-65019Medium 5.4
Astro Cloudflare adapter has a Stored Cross Site Scripting vulnerability in /_image endpoint
Affected: fixed in 5.15.9.
Fixed in 5.15.9 (released Nov 17, 2025, 2 days before disclosure).
The latest release, 7.4.7, is not affected.
6.3% of astro downloads last week were affected versions (740.6K).
CVE-2025-64757Low 3.5
Astro Development Server is Vulnerable to Arbitrary Local File Read
Affected: fixed in 5.14.3.
Fixed in 5.14.3 (released Oct 9, 2025, 41 days before disclosure).
The latest release, 7.4.7, is not affected.
5.2% of astro downloads last week were affected versions (609.5K).
CVE-2025-64745Low 2.7
Astro development server error page vulnerable to reflected Cross-site Scripting
Affected: from 5.2.0, fixed in 5.15.6.
Fixed in 5.15.6 (released Nov 13, 2025, the day of disclosure).
The latest release, 7.4.7, is not affected.
3.6% of astro downloads last week were affected versions (424.3K).
CVE-2025-64525Medium 6.5
Astro: URL manipulation via unsanitized headers leads to path-based middleware protections bypass, potential SSRF/cache-poisoning…
Affected: from 2.16.0, fixed in 5.15.5.
Fixed in 5.15.5 (released Nov 10, 2025, 3 days before disclosure).
The latest release, 7.4.7, is not affected.
5.9% of astro downloads last week were affected versions (694.9K).
CVE-2025-59837High 7.2
astro allows bypass of image proxy domain validation leading to SSRF and potential XSS
Affected: from 5.13.4, fixed in 5.13.10.
Fixed in 5.13.10 (released Sep 22, 2025, 36 days before disclosure).
The latest release, 7.4.7, is not affected.
0.3% of astro downloads last week were affected versions (33K).
CVE-2025-61925Medium 6.5
Astro's `X-Forwarded-Host` is reflected with no validation
Affected: fixed in 5.14.3.
Fixed in 5.14.3 (released Oct 9, 2025, 1 day before disclosure).
The latest release, 7.4.7, is not affected.
5.2% of astro downloads last week were affected versions (609.5K).
CVE-2025-55303Medium 6.9
Unauthorized third-party images in Astro’s _image endpoint
Affected: from 5.0.0-alpha.0, fixed in 5.13.2; fixed in 4.16.19.
Fixed in 4.16.19 (released Aug 19, 2025, the day of disclosure) and 5.13.2 (released Aug 15, 2025, 4 days before disclosure).
The latest release, 7.4.7, is not affected.
3% of astro downloads last week were affected versions (356.2K).
CVE-2025-54793Medium 5.5
Astro: Duplicate trailing slash feature can lead to Open Redirects
Affected: from 5.2.0, fixed in 5.12.8.
Fixed in 5.12.8 (released Aug 1, 2025, 7 days before disclosure).
The latest release, 7.4.7, is not affected.
1.7% of astro downloads last week were affected versions (205.4K).
CVE-2024-56159High 7.8
Server source code is exposed to the public if sourcemaps are enabled
Affected: from 5.0.0-alpha.0, fixed in 5.0.8; fixed in 4.16.18.
Fixed in 4.16.18 (released Dec 18, 2024, 1 day before disclosure) and 5.0.8 (released Dec 16, 2024, 3 days before disclosure).
The latest release, 7.4.7, is not affected.
1% of astro downloads last week were affected versions (113K).
CVE-2024-56140Medium 5.9
Bypass of CSRF Middleware in Astro
Affected: fixed in 4.16.17.
Fixed in 4.16.17 (released Dec 5, 2024, 13 days before disclosure).
The latest release, 7.4.7, is not affected.
0.9% of astro downloads last week were affected versions (107.9K).
CVE-2024-47885Medium 5.9
astro's client-side router has DOM Clobbering Gadget that leads to XSS
Affected: from 3.0.0, fixed in 4.16.1.
Fixed in 4.16.1 (released Oct 11, 2024, 3 days before disclosure).
The latest release, 7.4.7, is not affected.
0.5% of astro downloads last week were affected versions (56.6K).