CRITICAL9.8npm
GHSA-26w7-cxv4-gfx2Astro: Remote code execution through AVIF image optimization
Modified: 9/8/2026
package
npm/astro
pkg:npm/astro
HIGH7.5npm
GHSA-2pvr-wf23-7pc7· CVE-2026-54299Astro: Host header SSRF in prerendered error page fetch
Modified: 8/12/2026
MEDIUMnpm
GHSA-376h-93r7-7g6f· CVE-2026-84376Astro: Authorization bypass from missing path-segment boundary check when stripping the configured base
Modified: 9/8/2026
HIGHnpm
GHSA-49w6-73cw-chjr· CVE-2024-56159Astro's server source code is exposed to the public if sourcemaps are enabled
Modified: 11/27/2025
MEDIUMnpm
GHSA-4g3v-8h47-v7g6· CVE-2026-73422Astro: Reflected XSS via unescaped View Transition animation properties
Modified: 8/12/2026
MEDIUM6.5npm
GHSA-5ff5-9fcw-vg88· CVE-2025-61925Astro's `X-Forwarded-Host` is reflected without validation
Modified: 10/11/2025
LOWnpm
GHSA-7pw4-f3q4-r2p2· CVE-2026-59727Astro: Cross-site scripting via unescaped transition:* directive values on hydrated islands
Modified: 8/12/2026
HIGH7.1npm
GHSA-8hv8-536x-4wqp· CVE-2026-50146Astro: Reflected XSS via unescaped slot name
Modified: 8/12/2026
MEDIUMnpm
GHSA-8mv7-9c27-98vc· CVE-2026-73423Astro: composable `astro/hono` pipeline bypasses `security.checkOrigin` when `middleware()` is absent or misordered
Modified: 8/12/2026
MEDIUM5.9npm
GHSA-c4pw-33h3-35xw· CVE-2024-56140Atro CSRF Middleware Bypass (security.checkOrigin)
Modified: 11/27/2025
MEDIUMnpm
GHSA-cq8c-xv66-36gw· CVE-2025-54793Astros's duplicate trailing slash feature leads to an open redirection security issue
Modified: 11/27/2025
MEDIUMnpm
GHSA-f48w-9m4c-m7f5· CVE-2026-59729Astro: XSS via unescaped spread attribute names in renderHTMLElement (incomplete fix for CVE-2026-54298)
Modified: 8/12/2026
MEDIUM5.4npm
GHSA-fvmw-cj7j-j39q· CVE-2025-65019Astro Cloudflare adapter has Stored Cross-site Scripting vulnerability in /_image endpoint
Modified: 11/27/2025
MEDIUM5.3npm
GHSA-g735-7g2w-hh3f· CVE-2026-33769Astro: Remote allowlist bypass via unanchored matchPathname wildcard
Modified: 4/8/2026
MEDIUMnpm
GHSA-ggxq-hp9w-j794· CVE-2025-64765Astro's middleware authentication checks based on url.pathname can be bypassed via url encoded values
Modified: 2/4/2026
MEDIUM6.5npm
GHSA-hr2q-hp5q-x767· CVE-2025-64525Astro vulnerable to URL manipulation via headers, leading to middleware and CVE-2025-61925 bypass
Modified: 11/13/2025
MEDIUM6.1npm
GHSA-j687-52p2-xcff· CVE-2026-41067Astro: XSS in define:vars via incomplete </script> tag sanitization
Modified: 5/5/2026
MEDIUM4.2npm
GHSA-jrpj-wcv7-9fh9· CVE-2026-54298Astro: XSS via Unescaped Attribute Names in Spread Props
Modified: 7/18/2026
MEDIUM5.9npm
GHSA-m85w-3h95-hcf9· CVE-2024-47885DOM Clobbering Gadget found in astro's client-side router that leads to XSS
Modified: 11/27/2025
HIGH7.2npm
GHSA-qcpr-679q-rhm2· CVE-2025-59837Astro's bypass of image proxy domain validation leads to SSRF and potential XSS
Modified: 10/29/2025
HIGH8.2npm
GHSA-vj59-8hwv-xxmv· CVE-2026-59731Astro: Authorization Bypass via Decode Iteration Limit and Rewrite Path Canonicalization Mismatch
Modified: 7/20/2026
LOW2.7npm
GHSA-w2vj-39qv-7vh7· CVE-2025-64745Astro development server error page is vulnerable to reflected Cross-site Scripting
Modified: 11/27/2025
MEDIUM6.5npm
GHSA-whqg-ppgf-wp8c· CVE-2025-66202Astro has an Authentication Bypass via Double URL Encoding, a bypass for CVE-2025-64765
Modified: 2/4/2026
HIGH7.1npm
GHSA-wrwg-2hg8-v723· CVE-2025-64764Astro vulnerable to reflected XSS via the server islands feature
Modified: 11/20/2025
LOW3.5npm
GHSA-x3h8-62x9-952g· CVE-2025-64757Astro Development Server has Arbitrary Local File Read
Modified: 11/20/2025
MEDIUM6.1npm
GHSA-xf8x-j4p2-f749· CVE-2025-55303Astro allows unauthorized third-party images in _image endpoint
Modified: 11/27/2025
MEDIUM6.1npm
GHSA-xr5h-phrj-8vxv· CVE-2026-45028Astro: Server island encrypted parameters vulnerable to cross-component replay
Modified: 5/14/2026