astro (npm)
The web framework for content-driven websites.
Advisories
63
Latest version
7.4.2
Released Oct 21, 2026
License
MIT
OpenSSF Scorecard
—
How to fix
Upgrading to 7.3.3 or later clears every advisory below that has a fix.
Upgrade commands
npm
npm install astro@7.4.2yarn
yarn add astro@7.4.2pnpm
pnpm add astro@7.4.2Known vulnerabilities
| Advisory | Severity | Affected | Fixed in |
|---|---|---|---|
| GHSA-98hj-9722-w3j8 Astro: Reflected/Stored XSS via unescaped <script>/<style> tag content in JSX/MDX rendering |
Medium EPSS 0.32% |
< 7.3.2 | 7.3.2 |
| GHSA-98hj-9722-w3j8 Astro: Reflected/Stored XSS via unescaped <script>/<style> tag content in JSX/MDX rendering |
Medium EPSS 0.32% |
< 7.3.2 | 7.3.2 |
| GHSA-mpr7-6m5w-76rw Astro: Arbitrary CSS injection in Astro View Transitions |
Low EPSS 0.50% |
>= 7.1.0, <= 7.3.2 | No fix yet |
| GHSA-mpr7-6m5w-76rw Astro: Arbitrary CSS injection in Astro View Transitions |
Low EPSS 0.50% |
>= 7.1.0, < 7.3.3 | 7.3.3 |
| GHSA-26w7-cxv4-gfx2 Astro: Remote code execution through AVIF image optimization |
Critical | < 7.2.8 | 7.2.8 |
| GHSA-26w7-cxv4-gfx2 Astro: Remote code execution through AVIF image optimization |
Critical | < 7.2.8 | 7.2.8 |
| GHSA-376h-93r7-7g6f Astro: Authorization bypass from missing path-segment boundary check when stripping the configured base |
Medium EPSS 0.71% |
< 7.2.4 | 7.2.4 |
| GHSA-376h-93r7-7g6f Astro: Authorization bypass from missing path-segment boundary check when stripping the configured base |
Medium EPSS 0.71% |
<= 7.2.3 | No fix yet |
| GHSA-8mv7-9c27-98vc Astro: composable `astro/hono` pipeline bypasses `security.checkOrigin` when `middleware()` is absent or misordered |
Medium EPSS 0.26% |
>= 7.0.0, < 7.0.6 | 7.0.6 |
| GHSA-8mv7-9c27-98vc Astro: composable `astro/hono` pipeline bypasses `security.checkOrigin` when `middleware()` is absent or misordered |
Medium EPSS 0.26% |
>= 7.0.0, < 7.0.6 | 7.0.6 |
| GHSA-f48w-9m4c-m7f5 Astro: XSS via unescaped spread attribute names in renderHTMLElement (incomplete fix for CVE-2026-54298) |
Medium EPSS 0.47% |
< 7.0.6 | 7.0.6 |
| GHSA-f48w-9m4c-m7f5 Astro: XSS via unescaped spread attribute names in renderHTMLElement (incomplete fix for CVE-2026-54298) |
Medium EPSS 0.47% |
< 7.0.6 | 7.0.6 |
| GHSA-7pw4-f3q4-r2p2 Astro: Cross-site scripting via unescaped transition:* directive values on hydrated islands |
Low EPSS 0.39% |
>= 3.10.0, < 7.0.4 | 7.0.4 |
| GHSA-7pw4-f3q4-r2p2 Astro: Cross-site scripting via unescaped transition:* directive values on hydrated islands |
Low EPSS 0.39% |
>= 3.10.0, < 7.0.4 | 7.0.4 |
| GHSA-4g3v-8h47-v7g6 Astro: Reflected XSS via unescaped View Transition animation properties |
Medium EPSS 0.55% |
>= 2.9.0, <= 7.0.9 | No fix yet |
| GHSA-4g3v-8h47-v7g6 Astro: Reflected XSS via unescaped View Transition animation properties |
Medium EPSS 0.55% |
>= 2.9.0, < 7.1.0 | 7.1.0 |
| MAL-2026-10726 Malicious code in astro (npm) Withdrawn |
Not rated yet | No fix yet | |
| GHSA-vj59-8hwv-xxmv Astro: Authorization Bypass via Decode Iteration Limit and Rewrite Path Canonicalization Mismatch |
High EPSS 0.33% |
>= 6.4.7, < 6.4.8 | 6.4.8 |
| GHSA-vj59-8hwv-xxmv Astro: Authorization Bypass via Decode Iteration Limit and Rewrite Path Canonicalization Mismatch |
High EPSS 0.33% |
>= 6.4.7, < 6.4.8 | 6.4.8 |
| GHSA-jrpj-wcv7-9fh9 Astro: XSS via Unescaped Attribute Names in Spread Props |
Medium EPSS 0.23% |
< 6.4.6 | 6.4.6 |
| GHSA-jrpj-wcv7-9fh9 Astro: XSS via Unescaped Attribute Names in Spread Props |
Medium EPSS 0.23% |
< 6.4.6 | 6.4.6 |
| GHSA-2pvr-wf23-7pc7 Astro: Host header SSRF in prerendered error page fetch |
High EPSS 0.33% |
< 6.4.6 | 6.4.6 |
| GHSA-2pvr-wf23-7pc7 Astro: Host header SSRF in prerendered error page fetch |
High EPSS 0.33% |
< 6.4.6 | 6.4.6 |
| GHSA-8hv8-536x-4wqp Astro: Reflected XSS via unescaped slot name |
Medium EPSS 0.27% |
< 6.3.3 | 6.3.3 |
| GHSA-8hv8-536x-4wqp Astro: Reflected XSS via unescaped slot name |
Medium EPSS 0.27% |
< 6.3.3 | 6.3.3 |
| GHSA-xr5h-phrj-8vxv Astro: Server island encrypted parameters vulnerable to cross-component replay |
Low EPSS 0.14% |
< 6.1.10 | 6.1.10 |
| GHSA-xr5h-phrj-8vxv Astro: Server island encrypted parameters vulnerable to cross-component replay |
Low EPSS 0.14% |
< 6.1.10 | 6.1.10 |
| GHSA-j687-52p2-xcff Astro: XSS in define:vars via incomplete </script> tag sanitization |
Medium EPSS 0.19% |
< 6.1.6 | 6.1.6 |
| GHSA-j687-52p2-xcff Astro: XSS in define:vars via incomplete </script> tag sanitization |
Medium EPSS 0.19% |
< 6.1.6 | 6.1.6 |
| GHSA-g735-7g2w-hh3f Astro: Remote allowlist bypass via unanchored matchPathname wildcard |
Low EPSS 0.34% |
>= 2.10.10, < 5.18.1 | 5.18.1 |
| GHSA-g735-7g2w-hh3f Astro: Remote allowlist bypass via unanchored matchPathname wildcard |
Low EPSS 0.34% |
>= 2.10.10, < 5.18.1 | 5.18.1 |
| GHSA-whqg-ppgf-wp8c Astro has an Authentication Bypass via Double URL Encoding, a bypass for CVE-2025-64765 |
Medium EPSS 0.31% |
< 5.15.8 | 5.15.8 |
| GHSA-whqg-ppgf-wp8c Astro has an Authentication Bypass via Double URL Encoding, a bypass for CVE-2025-64765 |
Medium EPSS 0.31% |
< 5.15.8 | 5.15.8 |
| GHSA-fvmw-cj7j-j39q Astro Cloudflare adapter has Stored Cross-site Scripting vulnerability in /_image endpoint |
Medium EPSS 0.27% |
< 5.15.9 | 5.15.9 |
| GHSA-fvmw-cj7j-j39q Astro Cloudflare adapter has Stored Cross-site Scripting vulnerability in /_image endpoint |
Medium EPSS 0.27% |
< 5.15.9 | 5.15.9 |
| GHSA-ggxq-hp9w-j794 Astro's middleware authentication checks based on url.pathname can be bypassed via url encoded values |
Medium EPSS 0.54% |
< 5.15.8 | 5.15.8 |
| GHSA-ggxq-hp9w-j794 Astro's middleware authentication checks based on url.pathname can be bypassed via url encoded values |
Medium EPSS 0.54% |
< 5.15.8 | 5.15.8 |
| GHSA-wrwg-2hg8-v723 Astro vulnerable to reflected XSS via the server islands feature |
Medium EPSS 0.53% |
< 5.15.8 | 5.15.8 |
| GHSA-wrwg-2hg8-v723 Astro vulnerable to reflected XSS via the server islands feature |
Medium EPSS 0.53% |
<= 5.15.6 | No fix yet |
| GHSA-x3h8-62x9-952g Astro Development Server has Arbitrary Local File Read |
Low EPSS 0.43% |
< 5.14.3 | 5.14.3 |
| GHSA-x3h8-62x9-952g Astro Development Server has Arbitrary Local File Read |
Low EPSS 0.43% |
< 5.14.3 | 5.14.3 |
| GHSA-w2vj-39qv-7vh7 Astro development server error page is vulnerable to reflected Cross-site Scripting |
Medium EPSS 0.26% |
>= 5.2.0, < 5.15.6 | 5.15.6 |
| GHSA-w2vj-39qv-7vh7 Astro development server error page is vulnerable to reflected Cross-site Scripting |
Medium EPSS 0.26% |
>= 5.2.0, < 5.15.6 | 5.15.6 |
| GHSA-hr2q-hp5q-x767 Astro vulnerable to URL manipulation via headers, leading to middleware and CVE-2025-61925 bypass |
Medium EPSS 1.24% |
>= 2.16.0, < 5.15.5 | 5.15.5 |
| GHSA-hr2q-hp5q-x767 Astro vulnerable to URL manipulation via headers, leading to middleware and CVE-2025-61925 bypass |
Medium EPSS 1.24% |
>= 2.16.0, < 5.15.5 | 5.15.5 |
| GHSA-qcpr-679q-rhm2 Astro's bypass of image proxy domain validation leads to SSRF and potential XSS |
High EPSS 0.35% |
>= 5.13.4, < 5.13.10 | 5.13.10 |
| GHSA-qcpr-679q-rhm2 Astro's bypass of image proxy domain validation leads to SSRF and potential XSS |
High EPSS 0.35% |
>= 5.13.4, < 5.13.10 | 5.13.10 |
| GHSA-5ff5-9fcw-vg88 Astro's `X-Forwarded-Host` is reflected without validation |
Medium EPSS 0.41% |
< 5.14.3 | 5.14.3 |
| GHSA-5ff5-9fcw-vg88 Astro's `X-Forwarded-Host` is reflected without validation |
Medium EPSS 0.41% |
< 5.14.3 | 5.14.3 |
| GHSA-xf8x-j4p2-f749 Astro allows unauthorized third-party images in _image endpoint |
Medium EPSS 0.64% |
>= 5.0.0-alpha.0, < 5.13.2 | 5.13.2 |
| GHSA-xf8x-j4p2-f749 Astro allows unauthorized third-party images in _image endpoint |
Medium EPSS 0.64% |
<= 4.16.18 | No fix yet |
| GHSA-xf8x-j4p2-f749 Astro allows unauthorized third-party images in _image endpoint |
Medium EPSS 0.64% |
< 4.16.19 | 4.16.19 |
| GHSA-xf8x-j4p2-f749 Astro allows unauthorized third-party images in _image endpoint |
Medium EPSS 0.64% |
>= 5.0.0-alpha.0, < 5.13.2 | 5.13.2 |
| GHSA-cq8c-xv66-36gw Astros's duplicate trailing slash feature leads to an open redirection security issue |
Medium EPSS 0.70% |
>= 5.2.0, < 5.12.8 | 5.12.8 |
| GHSA-cq8c-xv66-36gw Astros's duplicate trailing slash feature leads to an open redirection security issue |
Medium EPSS 0.70% |
>= 5.2.0, < 5.12.8 | 5.12.8 |
| GHSA-49w6-73cw-chjr Astro's server source code is exposed to the public if sourcemaps are enabled |
High EPSS 1.54% |
>= 5.0.0-alpha.0, < 5.0.8 | 5.0.8 |
| GHSA-49w6-73cw-chjr Astro's server source code is exposed to the public if sourcemaps are enabled |
High EPSS 1.54% |
<= 4.16.17 | No fix yet |
| GHSA-49w6-73cw-chjr Astro's server source code is exposed to the public if sourcemaps are enabled |
High EPSS 1.54% |
< 4.16.18 | 4.16.18 |
| GHSA-49w6-73cw-chjr Astro's server source code is exposed to the public if sourcemaps are enabled |
High EPSS 1.54% |
>= 5.0.0-alpha.0, < 5.0.8 | 5.0.8 |
| GHSA-c4pw-33h3-35xw Atro CSRF Middleware Bypass (security.checkOrigin) |
Medium EPSS 0.22% |
< 4.16.17 | 4.16.17 |
| GHSA-c4pw-33h3-35xw Atro CSRF Middleware Bypass (security.checkOrigin) |
Medium EPSS 0.22% |
< 4.16.17 | 4.16.17 |
| GHSA-m85w-3h95-hcf9 DOM Clobbering Gadget found in astro's client-side router that leads to XSS |
Medium EPSS 0.45% |
>= 3.0.0, < 4.16.1 | 4.16.1 |
| GHSA-m85w-3h95-hcf9 DOM Clobbering Gadget found in astro's client-side router that leads to XSS |
Medium EPSS 0.45% |
>= 3.0.0, < 4.16.1 | 4.16.1 |
Source: git+https://github.com/withastro/astro.git
MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.
Check your repos with MergeHarbor