HIGH 7.1 npm
GHSA-8hv8-536x-4wqp · CVE-2026-50146 Astro: Reflected XSS via unescaped slot name
Modified: 6/16/2026
package
npm / astro
pkg:npm/astro
MEDIUM 5.4 npm
GHSA-fvmw-cj7j-j39q · CVE-2025-65019 Astro Cloudflare adapter has Stored Cross-site Scripting vulnerability in /_image endpoint
Modified: 11/27/2025
MEDIUM 5.9 npm
GHSA-c4pw-33h3-35xw · CVE-2024-56140 Atro CSRF Middleware Bypass (security.checkOrigin)
Modified: 11/27/2025
MEDIUM npm
GHSA-cq8c-xv66-36gw · CVE-2025-54793 Astros's duplicate trailing slash feature leads to an open redirection security issue
Modified: 11/27/2025
HIGH 7.5 npm
GHSA-2pvr-wf23-7pc7 · CVE-2026-54299 Astro: Host header SSRF in prerendered error page fetch
Modified: 6/16/2026
MEDIUM npm
GHSA-ggxq-hp9w-j794 · CVE-2025-64765 Astro's middleware authentication checks based on url.pathname can be bypassed via url encoded values
Modified: 2/4/2026
HIGH npm
GHSA-49w6-73cw-chjr · CVE-2024-56159 Astro's server source code is exposed to the public if sourcemaps are enabled
Modified: 11/27/2025
MEDIUM 6.5 npm
GHSA-5ff5-9fcw-vg88 · CVE-2025-61925 Astro's `X-Forwarded-Host` is reflected without validation
Modified: 10/11/2025
MEDIUM 5.9 npm
GHSA-m85w-3h95-hcf9 · CVE-2024-47885 DOM Clobbering Gadget found in astro's client-side router that leads to XSS
Modified: 11/27/2025
MEDIUM 5.3 npm
GHSA-g735-7g2w-hh3f · CVE-2026-33769 Astro: Remote allowlist bypass via unanchored matchPathname wildcard
Modified: 4/8/2026
MEDIUM 6.5 npm
GHSA-hr2q-hp5q-x767 · CVE-2025-64525 Astro vulnerable to URL manipulation via headers, leading to middleware and CVE-2025-61925 bypass
Modified: 11/13/2025
MEDIUM 6.1 npm
GHSA-j687-52p2-xcff · CVE-2026-41067 Astro: XSS in define:vars via incomplete </script> tag sanitization
Modified: 5/5/2026
MEDIUM 4.2 npm
GHSA-jrpj-wcv7-9fh9 · CVE-2026-54298 Astro: XSS via Unescaped Attribute Names in Spread Props
Modified: 6/16/2026
HIGH 7.2 npm
GHSA-qcpr-679q-rhm2 · CVE-2025-59837 Astro's bypass of image proxy domain validation leads to SSRF and potential XSS
Modified: 10/29/2025
LOW 2.7 npm
GHSA-w2vj-39qv-7vh7 · CVE-2025-64745 Astro development server error page is vulnerable to reflected Cross-site Scripting
Modified: 11/27/2025
MEDIUM 6.5 npm
GHSA-whqg-ppgf-wp8c · CVE-2025-66202 Astro has an Authentication Bypass via Double URL Encoding, a bypass for CVE-2025-64765
Modified: 2/4/2026
HIGH 7.1 npm
GHSA-wrwg-2hg8-v723 · CVE-2025-64764 Astro vulnerable to reflected XSS via the server islands feature
Modified: 11/20/2025
LOW 3.5 npm
GHSA-x3h8-62x9-952g · CVE-2025-64757 Astro Development Server has Arbitrary Local File Read
Modified: 11/20/2025
MEDIUM 6.1 npm
GHSA-xf8x-j4p2-f749 · CVE-2025-55303 Astro allows unauthorized third-party images in _image endpoint
Modified: 11/27/2025
MEDIUM 6.1 npm
GHSA-xr5h-phrj-8vxv · CVE-2026-45028 Astro: Server island encrypted parameters vulnerable to cross-component replay
Modified: 5/14/2026