# astro (npm) vulnerabilities 28 known vulnerabilities (6 high, 16 medium, 6 low), with the versions each affects and the releases that fix them. ## At a glance - Latest release: 7.4.7 (Nov 5, 2026): no advisory affects it - Newest unaffected release: 7.4.7 (Nov 5, 2026), the latest release - Weekly downloads: 10.8M - Dependents: 158 - Releases: 500+ since 4.6.1 (Apr 12, 2024) - Registry: https://www.npmjs.com/package/astro - Releases read: Nov 8, 2026 ## Version timeline Affected versions per advisory, in version order: - CVE-2026-114128: 0.0.0-actions-20240425172525 to 7.3.1 (7.3.2 is outside it) - CVE-2026-114127: 7.1.0 to 7.3.2 (7.3.3 is outside it) - CVE-2026-84376: 0.0.0-actions-20240425172525 to 7.2.3 (7.2.4 is outside it) - CVE-2026-73423: 7.0.0 to 7.0.5 (7.0.6 is outside it) - CVE-2026-73422: 4.6.1 to 7.0.9 (7.1.0 is outside it) - CVE-2026-59727: 4.6.1 to 7.0.3 (7.0.4 is outside it) - CVE-2026-59729: 0.0.0-actions-20240425172525 to 7.0.5 (7.0.6 is outside it) - CVE-2026-59731: 6.4.7 (6.4.8 is outside it) - CVE-2026-54299: 0.0.0-actions-20240425172525 to 6.4.5 (6.4.6 is outside it) - CVE-2026-54298: 0.0.0-actions-20240425172525 to 6.4.5 (6.4.6 is outside it) - CVE-2026-50146: 0.0.0-actions-20240425172525 to 6.3.2 (6.3.3 is outside it) - CVE-2026-45028: 0.0.0-actions-20240425172525 to 6.1.9 (6.1.10 is outside it) - CVE-2026-41067: 0.0.0-actions-20240425172525 to 6.1.5 (6.1.6 is outside it) - CVE-2026-33769: 4.6.1 to 5.18.0 (5.18.1 is outside it) - CVE-2025-66202: 0.0.0-actions-20240425172525 to 5.15.7 (5.15.8 is outside it) - CVE-2025-64765: 0.0.0-actions-20240425172525 to 5.15.7 (5.15.8 is outside it) - CVE-2025-64764: 0.0.0-actions-20240425172525 to 5.15.7 (5.15.8 is outside it) - CVE-2025-65019: 0.0.0-actions-20240425172525 to 5.15.8 (5.15.9 is outside it) - CVE-2025-64757: 0.0.0-actions-20240425172525 to 5.14.1 (5.14.3 is outside it) - CVE-2025-64745: 5.2.0 to 5.15.5 (5.15.6 is outside it) - CVE-2025-64525: 4.6.1 to 5.15.4 (5.15.5 is outside it) - CVE-2025-59837: 5.13.4 to 5.13.9 (5.13.10 is outside it) - CVE-2025-61925: 0.0.0-actions-20240425172525 to 5.14.1 (5.14.3 is outside it) - CVE-2025-55303: 0.0.0-actions-20240425172525 to 4.16.18 (4.16.19 is outside it); 5.0.0-alpha.0 to 5.13.1 (5.13.2 is outside it) - CVE-2025-54793: 5.2.0 to 5.12.7 (5.12.8 is outside it) - CVE-2024-56159: 0.0.0-actions-20240425172525 to 4.16.17 (4.16.18 is outside it); 5.0.0-alpha.0 to 5.0.7 (5.0.8 is outside it) - CVE-2024-56140: 0.0.0-actions-20240425172525 to 4.16.16 (4.16.17 is outside it) - CVE-2024-47885: 4.6.1 to 4.16.0 (4.16.1 is outside it) Older releases aren't stored, so the earliest spans may start sooner. ## Advisories (28) ### [CVE-2026-114128](https://cve.now/CVE-2026-114128): Astro: Reflected/Stored XSS via unescaped \/\ tag content in JSX/MDX rendering - Severity: Medium 6.5 - Published: Oct 21, 2026 - Affected: fixed in 7.3.2. - Fixed in 7.3.2 (released Sep 8, 2026, 43 days before disclosure). - The latest release, 7.4.7, is not affected. - 40% of astro downloads last week were affected versions (4.7M). ### [CVE-2026-114127](https://cve.now/CVE-2026-114127): Astro: Arbitrary CSS injection in Astro View Transitions - Severity: Low 2.3 - Published: Oct 21, 2026 - Affected: from 7.1.0, fixed in 7.3.3. - Fixed in 7.3.3 (released Sep 16, 2026, 35 days before disclosure). - The latest release, 7.4.7, is not affected. - 11% of astro downloads last week were affected versions (1.3M). ### [CVE-2026-84376](https://cve.now/CVE-2026-84376): Astro: Authorization bypass from missing path-segment boundary check when stripping the configured base - Severity: Medium 6.3 - Published: Sep 2, 2026 - Affected: fixed in 7.2.4. - Fixed in 7.2.4 (released Aug 19, 2026, 14 days before disclosure). - The latest release, 7.4.7, is not affected. - 35% of astro downloads last week were affected versions (4.2M). ### [CVE-2026-73423](https://cve.now/CVE-2026-73423): Astro: composable \`astro/hono\` pipeline bypasses \`security.checkOrigin\` when \`middleware()\` is absent or misordered - Severity: Medium 5.1 - Published: Aug 12, 2026 - Affected: from 7.0.0, fixed in 7.0.6. - Fixed in 7.0.6 (released Jul 2, 2026, 41 days before disclosure). - The latest release, 7.4.7, is not affected. - 0.6% of astro downloads last week were affected versions (73.6K). ### [CVE-2026-73422](https://cve.now/CVE-2026-73422): Astro: Reflected XSS via unescaped View Transition animation properties - Severity: Medium 5.3 - Published: Aug 12, 2026 - Affected: from 2.9.0, fixed in 7.1.0. - Fixed in 7.1.0 (released Jul 16, 2026, 27 days before disclosure). - The latest release, 7.4.7, is not affected. - 31% of astro downloads last week were affected versions (3.6M). ### [CVE-2026-59727](https://cve.now/CVE-2026-59727): Astro: Cross-site scripting via unescaped transition: directive values on hydrated islands - Severity: Low 2.1 - Published: Jul 27, 2026 - Affected: from 3.10.0, fixed in 7.0.4. - Fixed in 7.0.4 (released Jun 30, 2026, 27 days before disclosure). - The latest release, 7.4.7, is not affected. - 28% of astro downloads last week were affected versions (3.3M). ### [CVE-2026-59729](https://cve.now/CVE-2026-59729): Astro: XSS via unescaped spread attribute names in renderHTMLElement (incomplete fix for CVE-2026-54298) - Severity: Medium 5.1 - Published: Jul 27, 2026 - Affected: fixed in 7.0.6. - Fixed in 7.0.6 (released Jul 2, 2026, 25 days before disclosure). - The latest release, 7.4.7, is not affected. - 28% of astro downloads last week were affected versions (3.3M). ### [CVE-2026-59731](https://cve.now/CVE-2026-59731): Astro 6.4.7 Authorization Bypass via Decode Iteration Limit and Rewrite Path Canonicalization Mismatch - Severity: High 8.2 - Published: Jul 8, 2026 - Affected: from 6.4.7, fixed in 6.4.8. - Fixed in 6.4.8 (released Jun 17, 2026, 21 days before disclosure). - The latest release, 7.4.7, is not affected. - 0.1% of astro downloads last week were affected versions (16.9K). ### [CVE-2026-54299](https://cve.now/CVE-2026-54299): Astro: Host-header full-read SSRF in core prerendered error-page fetch (prerenderedErrorPageFetch default + unvalidated… - Severity: High 7.5 - Published: Jun 22, 2026 - Affected: fixed in 6.4.6. - Fixed in 6.4.6 (released Jun 10, 2026, 12 days before disclosure). - The latest release, 7.4.7, is not affected. - 23% of astro downloads last week were affected versions (2.7M). ### [CVE-2026-54298](https://cve.now/CVE-2026-54298): Astro: XSS via Unescaped Attribute Names in Spread Props - Severity: Medium 4.2 - Published: Jun 22, 2026 - Affected: fixed in 6.4.6. - Fixed in 6.4.6 (released Jun 10, 2026, 12 days before disclosure). - The latest release, 7.4.7, is not affected. - 23% of astro downloads last week were affected versions (2.7M). ### [CVE-2026-50146](https://cve.now/CVE-2026-50146): Astro: Reflected XSS via unescaped slot name - Severity: High 7.1 - Published: Jun 22, 2026 - Affected: fixed in 6.3.3. - Fixed in 6.3.3 (released May 14, 2026, 39 days before disclosure). - The latest release, 7.4.7, is not affected. - 22% of astro downloads last week were affected versions (2.6M). ### [CVE-2026-45028](https://cve.now/CVE-2026-45028): Astro: Server island encrypted parameters vulnerable to cross-component replay - Severity: Low 2.9 - Published: May 13, 2026 - Affected: fixed in 6.1.10. - Fixed in 6.1.10 (released Apr 28, 2026, 15 days before disclosure). - The latest release, 7.4.7, is not affected. - 21% of astro downloads last week were affected versions (2.5M). ### [CVE-2026-41067](https://cve.now/CVE-2026-41067): Astro: XSS via incomplete \`\\` sanitization in \`define:vars\` allows case-insensitive and whitespace-based bypass - Severity: Medium 6.1 - Published: Apr 24, 2026 - Affected: fixed in 6.1.6. - Fixed in 6.1.6 (released Apr 13, 2026, 11 days before disclosure). - The latest release, 7.4.7, is not affected. - 20% of astro downloads last week were affected versions (2.4M). ### [CVE-2026-33769](https://cve.now/CVE-2026-33769): Astro: Remote allowlist bypass via unanchored matchPathname wildcard - Severity: Low 2.9 - Published: Mar 24, 2026 - Affected: from 2.10.10, fixed in 5.18.1. - Fixed in 5.18.1 (released Mar 10, 2026, 14 days before disclosure). - The latest release, 7.4.7, is not affected. - 7.7% of astro downloads last week were affected versions (917.1K). ### [CVE-2025-66202](https://cve.now/CVE-2025-66202): Astro has an Authentication Bypass via Double URL Encoding, a bypass for CVE-2025-64765 - Severity: Medium 6.5 - Published: Dec 8, 2025 - Affected: fixed in 5.15.8. - Fixed in 5.15.8 (released Nov 15, 2025, 23 days before disclosure). - The latest release, 7.4.7, is not affected. - 6.3% of astro downloads last week were affected versions (740K). ### [CVE-2025-64765](https://cve.now/CVE-2025-64765): Astro middleware authentication checks based on url.pathname can be bypassed via url encoded values - Severity: Medium 6.9 - Published: Nov 19, 2025 - Affected: fixed in 5.15.8. - Fixed in 5.15.8 (released Nov 15, 2025, 4 days before disclosure). - The latest release, 7.4.7, is not affected. - 6.3% of astro downloads last week were affected versions (740K). ### [CVE-2025-64764](https://cve.now/CVE-2025-64764): Astro is vulnerable to Reflected XSS via the server islands feature - Severity: High 7.1 - Published: Nov 19, 2025 - Affected: fixed in 5.15.8. - Fixed in 5.15.8 (released Nov 15, 2025, 4 days before disclosure). - The latest release, 7.4.7, is not affected. - 6.3% of astro downloads last week were affected versions (740K). ### [CVE-2025-65019](https://cve.now/CVE-2025-65019): Astro Cloudflare adapter has a Stored Cross Site Scripting vulnerability in /\_image endpoint - Severity: Medium 5.4 - Published: Nov 19, 2025 - Affected: fixed in 5.15.9. - Fixed in 5.15.9 (released Nov 17, 2025, 2 days before disclosure). - The latest release, 7.4.7, is not affected. - 6.3% of astro downloads last week were affected versions (740.6K). ### [CVE-2025-64757](https://cve.now/CVE-2025-64757): Astro Development Server is Vulnerable to Arbitrary Local File Read - Severity: Low 3.5 - Published: Nov 19, 2025 - Affected: fixed in 5.14.3. - Fixed in 5.14.3 (released Oct 9, 2025, 41 days before disclosure). - The latest release, 7.4.7, is not affected. - 5.2% of astro downloads last week were affected versions (609.5K). ### [CVE-2025-64745](https://cve.now/CVE-2025-64745): Astro development server error page vulnerable to reflected Cross-site Scripting - Severity: Low 2.7 - Published: Nov 13, 2025 - Affected: from 5.2.0, fixed in 5.15.6. - Fixed in 5.15.6 (released Nov 13, 2025, the day of disclosure). - The latest release, 7.4.7, is not affected. - 3.6% of astro downloads last week were affected versions (424.3K). ### [CVE-2025-64525](https://cve.now/CVE-2025-64525): Astro: URL manipulation via unsanitized headers leads to path-based middleware protections bypass, potential SSRF/cache-poisoning… - Severity: Medium 6.5 - Published: Nov 13, 2025 - Affected: from 2.16.0, fixed in 5.15.5. - Fixed in 5.15.5 (released Nov 10, 2025, 3 days before disclosure). - The latest release, 7.4.7, is not affected. - 5.9% of astro downloads last week were affected versions (694.9K). ### [CVE-2025-59837](https://cve.now/CVE-2025-59837): astro allows bypass of image proxy domain validation leading to SSRF and potential XSS - Severity: High 7.2 - Published: Oct 28, 2025 - Affected: from 5.13.4, fixed in 5.13.10. - Fixed in 5.13.10 (released Sep 22, 2025, 36 days before disclosure). - The latest release, 7.4.7, is not affected. - 0.3% of astro downloads last week were affected versions (33K). ### [CVE-2025-61925](https://cve.now/CVE-2025-61925): Astro's \`X-Forwarded-Host\` is reflected with no validation - Severity: Medium 6.5 - Published: Oct 10, 2025 - Affected: fixed in 5.14.3. - Fixed in 5.14.3 (released Oct 9, 2025, 1 day before disclosure). - The latest release, 7.4.7, is not affected. - 5.2% of astro downloads last week were affected versions (609.5K). ### [CVE-2025-55303](https://cve.now/CVE-2025-55303): Unauthorized third-party images in Astro’s \_image endpoint - Severity: Medium 6.9 - Published: Aug 19, 2025 - Affected: from 5.0.0-alpha.0, fixed in 5.13.2; fixed in 4.16.19. - Fixed in 4.16.19 (released Aug 19, 2025, the day of disclosure) and 5.13.2 (released Aug 15, 2025, 4 days before disclosure). - The latest release, 7.4.7, is not affected. - 3% of astro downloads last week were affected versions (356.2K). ### [CVE-2025-54793](https://cve.now/CVE-2025-54793): Astro: Duplicate trailing slash feature can lead to Open Redirects - Severity: Medium 5.5 - Published: Aug 8, 2025 - Affected: from 5.2.0, fixed in 5.12.8. - Fixed in 5.12.8 (released Aug 1, 2025, 7 days before disclosure). - The latest release, 7.4.7, is not affected. - 1.7% of astro downloads last week were affected versions (205.4K). ### [CVE-2024-56159](https://cve.now/CVE-2024-56159): Server source code is exposed to the public if sourcemaps are enabled - Severity: High 7.8 - Published: Dec 19, 2024 - Affected: from 5.0.0-alpha.0, fixed in 5.0.8; fixed in 4.16.18. - Fixed in 4.16.18 (released Dec 18, 2024, 1 day before disclosure) and 5.0.8 (released Dec 16, 2024, 3 days before disclosure). - The latest release, 7.4.7, is not affected. - 1% of astro downloads last week were affected versions (113K). ### [CVE-2024-56140](https://cve.now/CVE-2024-56140): Bypass of CSRF Middleware in Astro - Severity: Medium 5.9 - Published: Dec 18, 2024 - Affected: fixed in 4.16.17. - Fixed in 4.16.17 (released Dec 5, 2024, 13 days before disclosure). - The latest release, 7.4.7, is not affected. - 0.9% of astro downloads last week were affected versions (107.9K). ### [CVE-2024-47885](https://cve.now/CVE-2024-47885): astro's client-side router has DOM Clobbering Gadget that leads to XSS - Severity: Medium 5.9 - Published: Oct 14, 2024 - Affected: from 3.0.0, fixed in 4.16.1. - Fixed in 4.16.1 (released Oct 11, 2024, 3 days before disclosure). - The latest release, 7.4.7, is not affected. - 0.5% of astro downloads last week were affected versions (56.6K). --- Source: cve.now Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards. Page: https://cve.now/packages/npm/astro Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.