Withastro vulnerabilities
We track 9 vulnerabilities in Withastro products. 9 are rated high or critical, and none are known to be exploited. The most recent was published on September 30, 2026.
Latest Withastro vulnerabilities
- 8.2 High severity
astro: Uncaught Exception
Astro is a web framework for content-driven websites. Prior to 11.1.3, the @astrojs/node adapter builds a request URL from the Host header, and a malformed port can make that URL invalid. The recovery path reuses the same malformed host and throws an uncaught
- 8.2 High severity
astro: Use of Non-Canonical URL Paths for Authorization Decisions
Astro is a web framework for content-driven websites. Version 6.4.7 performs authorization decisions on a partially decoded pathname after reaching the iterative URL decoder limit, while later rewrite route matching performs an additional decodeURI() operation
- 7.5 High severity
Astro is a web framework. Prior to 6.4.6, Astro SSR apps with prerendered error pages (/404 or…
Astro is a web framework. Prior to 6.4.6, Astro SSR apps with prerendered error pages (/404 or /500 using export const prerender = true) fetch those pages over HTTP at runtime when an error occurs. The URL for this fetch is derived from request.url, which in t
- 9.1 Critical severity
astro: Unintended Proxy or Intermediary
Astro is a web framework. Prior to version 10.0.2, the @astrojs/vercel serverless entrypoint reads the x-astro-path header and x_astro_path query parameter to rewrite the internal request path, with no authentication whatsoever. On deployments without Edge Mid
- 7.5 High severity
astro: Allocation of Resources Without Limits or Throttling
Astro is a web framework. Prior to version 10.0.0, Astro's Server Islands POST handler buffers and parses the full request body as JSON without enforcing a size limit. Because JSON.parse() allocates a V8 heap object for every element in the input, a crafted pa
- 7.2 High severity
astro: Server-Side Request Forgery
Astro is a web framework. In versions 9.0.0 through 9.5.3, a bug in Astro's image pipeline allows bypassing `image.domains` / `image.remotePatterns` restrictions, enabling the server to fetch content from unauthorized remote hosts. Astro provides an `inferSize
- 7.5 High severity
astro: Allocation of Resources Without Limits or Throttling
Astro is a web framework. In versions 9.0.0 through 9.5.3, Astro server actions have no default request body size limit, which can lead to memory exhaustion DoS. A single large POST to a valid action endpoint can crash the server process on memory-constrained
- 8.6 High severity
astro: Server-Side Request Forgery
Astro is a web framework. Prior to version 9.5.4, Server-Side Rendered pages that return an error with a prerendered custom error page (eg. `404.astro` or `500.astro`) are vulnerable to SSRF. If the `Host:` header is changed to an attacker's server, it will be
- 7.2 High severity
astro: Improper Neutralization of Input During Web Page Generation
Astro is a web framework that includes an image proxy. In versions 5.13.4 and later before 5.13.10, the image proxy domain validation can be bypassed by using backslashes in the href parameter, allowing server-side requests to arbitrary URLs. This can lead to