withastro astro vulnerabilities

CVEs per yearBy the year they were published

1. 20243
2. 202513
3. 202627

Newest CVEs

• CVE-2026-114128

  Astro: Reflected/Stored XSS via unescaped <script>/<style> tag content in JSX/MDX rendering

  withastro · astro

  Medium6.5
• CVE-2026-114127

  Astro: Arbitrary CSS injection in Astro View Transitions

  withastro · astro

  Low2.3
• CVE-2026-102984

  Astro: Malformed port in the Host header can crash the Node adapter

  withastro · astro

  High8.2
• CVE-2026-102983

  Astro: Netlify Image CDN allowlist bypass enables SSRF

  withastro · astro

  Medium6.3
• CVE-2026-84376

  Astro: Authorization bypass from missing path-segment boundary check when stripping the configured base

  withastro · astro

  Medium6.3
• CVE-2026-73424

  Astro: Unauthenticated path override in the @astrojs/vercel ISR function

  withastro · astro

  Medium6.5
• CVE-2026-73425

  @astrojs/netlify generates an overly-broad Netlify Image CDN allowlist because remotePatterns.pathname metacharacters are not escaped

  withastro · astro

  Low3.7
• CVE-2026-73423

  Astro: composable `astro/hono` pipeline bypasses `security.checkOrigin` when `middleware()` is absent or misordered

  withastro · astro

  Medium5.1
• CVE-2026-73422

  Astro: Reflected XSS via unescaped View Transition animation properties

  withastro · astro

  Medium5.3
• CVE-2026-59730

  @astrojs/node: Backslash-prefixed paths not recognized as internal by trailing-slash redirect

  withastro · astro

  Low2.1