Withastro vulnerabilities
44 CVEs and advisories name Withastro as an affected vendor, newest first. Follow it as a feed.
- CVE-2026-114128Astro: Reflected/Stored XSS via unescaped <script>/<style> tag content in JSX/MDX rendering
- CVE-2026-114127Astro: Arbitrary CSS injection in Astro View Transitions
- CVE-2026-102984Astro: Malformed port in the Host header can crash the Node adapter
- CVE-2026-102983Astro: Netlify Image CDN allowlist bypass enables SSRF
- CVE-2026-84376Astro: Authorization bypass from missing path-segment boundary check when stripping the configured base
- CVE-2026-73424Astro: Unauthenticated path override in the @astrojs/vercel ISR function
- CVE-2026-73425@astrojs/netlify generates an overly-broad Netlify Image CDN allowlist because remotePatterns.pathname metacharacters are not escaped
- CVE-2026-73423Astro: composable `astro/hono` pipeline bypasses `security.checkOrigin` when `middleware()` is absent or misordered
- CVE-2026-73422Astro: Reflected XSS via unescaped View Transition animation properties
- CVE-2026-59730@astrojs/node: Backslash-prefixed paths not recognized as internal by trailing-slash redirect
- CVE-2026-59728@astrojs/rss: XML Injection via Unescaped RSS Feed Fields
- CVE-2026-59727Astro: Cross-site scripting via unescaped transition:* directive values on hydrated islands
- CVE-2026-59729Astro: XSS via unescaped spread attribute names in renderHTMLElement (incomplete fix for CVE-2026-54298)
- CVE-2026-59731Astro 6.4.7 Authorization Bypass via Decode Iteration Limit and Rewrite Path Canonicalization Mismatch
- CVE-2026-54299Astro: Host-header full-read SSRF in core prerendered error-page fetch (prerenderedErrorPageFetch default + unvalidated createRequestFromNodeRequest URL)
- CVE-2026-54298Astro: XSS via Unescaped Attribute Names in Spread Props
- CVE-2026-50146Astro: Reflected XSS via unescaped slot name
- CVE-2026-54300@astrojs/netlify broadens Astro image.remotePatterns in Netlify Image CDN config
- CVE-2026-45028Astro: Server island encrypted parameters vulnerable to cross-component replay
- CVE-2026-41322@astrojs/node: Cache Poisoning due to incorrect error handling when if-match header is malformed
- CVE-2026-41321@astrojs/cloudflare: SSRF via redirect following in Cloudflare image-binding-transform endpoint
- CVE-2026-41067Astro: XSS via incomplete `</script>` sanitization in `define:vars` allows case-insensitive and whitespace-based bypass
- CVE-2026-33769Astro: Remote allowlist bypass via unanchored matchPathname wildcard
- CVE-2026-33768Astro: Unauthenticated Path Override via `x-astro-path` / `x_astro_path`
- CVE-2026-29772Astro: Memory exhaustion DoS due to missing request body size limit in Server Islands
- CVE-2026-27829Astro is vulnerable to SSRF due to missing allowlist enforcement in remote image inferSize
- CVE-2026-27729Astro has memory exhaustion DoS due to missing request body size limit in Server Actions
- CVE-2026-25545Astro has Full-Read SSRF in error rendering via Host: header injection
- CVE-2025-66202Astro has an Authentication Bypass via Double URL Encoding, a bypass for CVE-2025-64765
- CVE-2025-64765Astro middleware authentication checks based on url.pathname can be bypassed via url encoded values