Product by Withastro
Astro
43 known vulnerabilities in Astro (Withastro), 0 of them actively exploited (CISA KEV).
Key figures
43
Vulnerabilities
0
Actively exploited (KEV)
0
Used by ransomware
1
Critical
Vulnerabilities
Actively exploited vulnerabilities (CISA KEV) first, then by priority. Click a column header to re-sort the table.
| High | CVE-2026-25545 | Astro has Full-Read SSRF in error rendering via Host: header injection | 8.6 | |
| High | CVE-2024-56159 | Server source code is exposed to the public if sourcemaps are enabled | 5.3 | |
| Medium | CVE-2025-64525 | Withastro Astro: Server-Side Request Forgery (SSRF) | 6.5 | |
| Medium | CVE-2026-84376 | Withastro Astro: Partial String Comparison | — | |
| High | CVE-2026-102984 | Astro: Malformed port in the Host header can crash the Node adapter | — | |
| High | CVE-2025-58179 | Astro Cloudflare adapter is vulnerable to Server-Side Request Forgery via /_image endpoint | 7.2 | |
| Medium | CVE-2026-114128 | Astro: Reflected/Stored XSS via unescaped <script>/<style> tag content in JSX/MDX rendering | 6.5 | |
| High | CVE-2026-59731 | Withastro Astro: Use of Non-Canonical URL Paths for Authorization Decisions | 8.2 | |
| Medium | CVE-2026-73422 | Astro: Reflected XSS via unescaped View Transition animation properties | — | |
| Medium | CVE-2026-102983 | Astro: Netlify Image CDN allowlist bypass enables SSRF | — | |
| Medium | CVE-2025-55303 | Unauthorized third-party images in Astro’s _image endpoint | 6.1 | |
| Medium | CVE-2026-73424 | Astro: Unauthenticated path override in the @astrojs/vercel ISR function | 6.5 | |
| High | CVE-2025-64764 | Astro is vulnerable to Reflected XSS via the server islands feature | 7.1 | |
| Medium | CVE-2025-54793 | Astro: Duplicate trailing slash feature can lead to Open Redirects | 6.1 | |
| Medium | CVE-2025-64765 | Astro middleware authentication checks based on url.pathname can be bypassed via url encoded values | 5.3 | |
| High | CVE-2026-54299 | Withastro Astro: Server-Side Request Forgery (SSRF) | 7.5 | |
| Medium | CVE-2026-59729 | Withastro Astro: Cross-site Scripting | — | |
| High | CVE-2026-27729 | Astro has memory exhaustion DoS due to missing request body size limit in Server Actions | 5.9 | |
| Low | CVE-2026-114127 | Astro: Arbitrary CSS injection in Astro View Transitions | — | |
| Medium | CVE-2025-55207 | @astrojs/node's trailing slash handling causes open redirect issue | — | |
| High | CVE-2025-59837 | astro allows bypass of image proxy domain validation leading to SSRF and potential XSS | 7.2 | |
| Critical | CVE-2026-33768 | Astro: Unauthenticated Path Override via `x-astro-path` / `x_astro_path` | 6.5 | |
| Medium | CVE-2025-61925 | Astro's `X-Forwarded-Host` is reflected with no validation | 6.5 | |
| High | CVE-2026-29772 | Astro: Memory exhaustion DoS due to missing request body size limit in Server Islands | 5.9 | |
| High | CVE-2026-50146 | Astro: Reflected XSS via unescaped slot name | 6.1 |