Vendor
Astro
26 known vulnerabilities in products by Astro, 0 of them actively exploited (CISA KEV).
Key figures
26
Vulnerabilities
0
Actively exploited (KEV)
0
Used by ransomware
1
Critical
Vulnerabilities
Actively exploited vulnerabilities (CISA KEV) first, then by priority. Click a column header to re-sort the table.
| High | CVE-2026-25545 | Astro has Full-Read SSRF in error rendering via Host: header injection | 8.6 | |
| High | CVE-2024-56159 | Server source code is exposed to the public if sourcemaps are enabled | 5.3 | |
| Medium | CVE-2025-64525 | Withastro Astro: Server-Side Request Forgery (SSRF) | 6.5 | |
| High | CVE-2025-58179 | Astro Cloudflare adapter is vulnerable to Server-Side Request Forgery via /_image endpoint | 7.2 | |
| Medium | CVE-2025-55303 | Unauthorized third-party images in Astro’s _image endpoint | 6.1 | |
| High | CVE-2025-64764 | Astro is vulnerable to Reflected XSS via the server islands feature | 7.1 | |
| Medium | CVE-2025-54793 | Astro: Duplicate trailing slash feature can lead to Open Redirects | 6.1 | |
| Medium | CVE-2025-64765 | Astro middleware authentication checks based on url.pathname can be bypassed via url encoded values | 5.3 | |
| High | CVE-2026-54299 | Withastro Astro: Server-Side Request Forgery (SSRF) | 7.5 | |
| High | CVE-2026-27729 | Astro has memory exhaustion DoS due to missing request body size limit in Server Actions | 5.9 | |
| High | CVE-2025-59837 | astro allows bypass of image proxy domain validation leading to SSRF and potential XSS | 7.2 | |
| Critical | CVE-2026-33768 | Astro: Unauthenticated Path Override via `x-astro-path` / `x_astro_path` | 6.5 | |
| Medium | CVE-2025-61925 | Astro's `X-Forwarded-Host` is reflected with no validation | 6.5 | |
| High | CVE-2026-29772 | Astro: Memory exhaustion DoS due to missing request body size limit in Server Islands | 5.9 | |
| High | CVE-2026-50146 | Astro: Reflected XSS via unescaped slot name | 6.1 | |
| High | CVE-2026-27829 | Astro is vulnerable to SSRF due to missing allowlist enforcement in remote image inferSize | 6.5 | |
| Medium | CVE-2026-54298 | Astro: XSS via Unescaped Attribute Names in Spread Props | 6.1 | |
| Medium | CVE-2025-66202 | Astro has an Authentication Bypass via Double URL Encoding, a bypass for CVE-2025-64765 | 6.5 | |
| Medium | CVE-2024-47885 | astro's client-side router has DOM Clobbering Gadget that leads to XSS | 5.9 | |
| Medium | CVE-2026-45028 | Astro: Server island encrypted parameters vulnerable to cross-component replay | 6.1 | |
| Medium | CVE-2026-33769 | Astro: Remote allowlist bypass via unanchored matchPathname wildcard | 5.3 | |
| Medium | CVE-2026-41067 | Withastro Astro: Cross-site Scripting | 6.1 | |
| Medium | CVE-2025-65019 | Astro Cloudflare adapter has a Stored Cross Site Scripting vulnerability in /_image endpoint | 5.4 | |
| Low | CVE-2025-64757 | Astro Development Server is Vulnerable to Arbitrary Local File Read | 3.5 | |
| Medium | CVE-2024-56140 | Bypass of CSRF Middleware in Astro | 5.9 |
Products
| Astro | 20 | 0 |
| \@astrojs\/node | 4 | 0 |