astro vulnerabilities

Browse known CVEs and advisories by package and ecosystem. Severity tells you the worst case. What determines real risk is whether the vulnerable code actually runs in your applications.

Get a demo

Browse by ecosystem

npmPyPIMavenGoRubyGemsCargoNuGetComposerpubSwiftGitHub Actions
CVE-IDSeverityPackage summary
CVE-2026-114128Mediumastro: Astro: Reflected/Stored XSS via unescaped <script>/<style> tag content in JSX/MDX renderingCVE-2026-114127Lowastro: Astro: Arbitrary CSS injection in Astro View TransitionsGHSA-26W7-CXV4-GFX2Criticalastro: Astro: Remote code execution through AVIF image optimizationCVE-2026-84376Mediumastro: Astro: Authorization bypass from missing path-segment boundary check when stripping the configured baseCVE-2026-73423Mediumastro: Astro: composable `astro/hono` pipeline bypasses `security.checkOrigin` when `middleware()` is absent or misorderedCVE-2026-59729Mediumastro: Astro: XSS via unescaped spread attribute names in renderHTMLElement (incomplete fix for CVE-2026-54298)CVE-2026-59727Lowastro: Astro: Cross-site scripting via unescaped transition:* directive values on hydrated islandsCVE-2026-59731Highastro: Astro: Authorization Bypass via Decode Iteration Limit and Rewrite Path Canonicalization MismatchCVE-2026-73422Mediumastro: Astro: Reflected XSS via unescaped View Transition animation propertiesCVE-2026-54298Mediumastro: Astro: XSS via Unescaped Attribute Names in Spread PropsCVE-2026-54299Highastro: Astro: Host header SSRF in prerendered error page fetchCVE-2026-50146Highastro: Astro: Reflected XSS via unescaped slot nameCVE-2026-45028Lowastro: Astro: Server island encrypted parameters vulnerable to cross-component replayCVE-2026-41067Mediumastro: Astro: XSS in define:vars via incomplete </script> tag sanitizationCVE-2026-33769Lowastro: Astro: Remote allowlist bypass via unanchored matchPathname wildcardCVE-2025-66202Mediumastro: Astro has an Authentication Bypass via Double URL Encoding, a bypass for CVE-2025-64765CVE-2025-65019Mediumastro: Astro Cloudflare adapter has Stored Cross-site Scripting vulnerability in /_image endpointCVE-2025-64765Mediumastro: Astro's middleware authentication checks based on url.pathname can be bypassed via url encoded valuesCVE-2025-64764Highastro: Astro vulnerable to reflected XSS via the server islands featureCVE-2025-64757Lowastro: Astro Development Server has Arbitrary Local File ReadCVE-2025-64525Mediumastro: Astro vulnerable to URL manipulation via headers, leading to middleware and CVE-2025-61925 bypassCVE-2025-64745Lowastro: Astro development server error page is vulnerable to reflected Cross-site ScriptingCVE-2025-59837Highastro: Astro's bypass of image proxy domain validation leads to SSRF and potential XSSCVE-2025-61925Mediumastro: Astro's `X-Forwarded-Host` is reflected without validationCVE-2025-55303Medium@astrojs/node: Astro allows unauthorized third-party images in _image endpoint

Stop the waste.
Protect your environment with Kodem.

Get a personalized demo
Get a personalized demo