Data

Tools

Indexes

Applications

Experiments

Advisories

An open API service providing security vulnerability metadata for many open source software ecosystems.

npm

astro

npm

Astro is a modern site builder with web best practices, performance, and DX front-of-mind.

View on github.com · View on npmjs.org

Security Advisories for astro in npm

Moderate
29 days ago

Astro: composable `astro/hono` pipeline bypasses `security.checkOrigin` when `middleware()` is absent or misordered GSA_kwCzR0hTQS04bXY3LTljMjctOTh2Y84ABcRi

npm astro
Moderate
29 days ago

Astro: XSS via unescaped spread attribute names in renderHTMLElement (incomplete fix for CVE-2026-54298) GSA_kwCzR0hTQS1mNDh3LTltNGMtbTdmNc4ABcRe

npm astro
Low
29 days ago

Astro: Cross-site scripting via unescaped transition:* directive values on hydrated islands GSA_kwCzR0hTQS03cHc0LWYzcTQtcjJwMs4ABcRc

npm astro
High
29 days ago

Astro: Authorization Bypass via Decode Iteration Limit and Rewrite Path Canonicalization Mismatch GSA_kwCzR0hTQS12ajU5LThod3YteHhtds4ABcQ8

npm astro
Moderate
29 days ago

Astro: Reflected XSS via unescaped View Transition animation properties GSA_kwCzR0hTQS00ZzN2LThoNDctdjdnNs4ABcPz

npm astro
Moderate
2 months ago

Astro: XSS via Unescaped Attribute Names in Spread Props GSA_kwCzR0hTQS1qcnBqLXdjdjctOWZoOc4ABYzL

npm astro
High
2 months ago

Astro: Host header SSRF in prerendered error page fetch GSA_kwCzR0hTQS0ycHZyLXdmMjMtN3BjN84ABYzI

npm astro
High
2 months ago

Astro: Reflected XSS via unescaped slot name GSA_kwCzR0hTQS04aHY4LTUzNngtNHdxcM4ABYy4

npm astro
Low
3 months ago

Astro: Server island encrypted parameters vulnerable to cross-component replay GSA_kwCzR0hTQS14cjVoLXBocmotOHZ4ds4ABWyA

npm astro
Moderate
4 months ago

Astro: XSS in define:vars via incomplete </script> tag sanitization GSA_kwCzR0hTQS1qNjg3LTUycDIteGNmZs4ABViM

npm astro
Low
5 months ago

Astro: Remote allowlist bypass via unanchored matchPathname wildcard GSA_kwCzR0hTQS1nNzM1LTdnMnctaGgzZs4ABUVJ

npm astro
Moderate
8 months ago

Astro has an Authentication Bypass via Double URL Encoding, a bypass for CVE-2025-64765 GSA_kwCzR0hTQS13aHFnLXBwZ2Ytd3A4Y84ABPSy

npm astro
Moderate
9 months ago

Astro Cloudflare adapter has Stored Cross-site Scripting vulnerability in /_image endpoint GSA_kwCzR0hTQS1mdm13LWNqN2otajM5cc4ABOsI

npm astro
Moderate
9 months ago

Astro's middleware authentication checks based on url.pathname can be bypassed via url encoded values GSA_kwCzR0hTQS1nZ3hxLWhwOXctajc5NM4ABOsH

npm astro
High
9 months ago

Astro vulnerable to reflected XSS via the server islands feature GSA_kwCzR0hTQS13cndnLTJoZzgtdjcyM84ABOsG

npm astro
Low
9 months ago

Astro Development Server has Arbitrary Local File Read GSA_kwCzR0hTQS14M2g4LTYyeDktOTUyZ84ABOsF

npm astro
Moderate
9 months ago

Astro vulnerable to URL manipulation via headers, leading to middleware and CVE-2025-61925 bypass GSA_kwCzR0hTQS1ocjJxLWhwNXEteDc2N84ABOia

npm astro
Low
9 months ago

Astro development server error page is vulnerable to reflected Cross-site Scripting GSA_kwCzR0hTQS13MnZqLTM5cXYtN3ZoN84ABOiZ

npm astro
High
10 months ago

Astro's bypass of image proxy domain validation leads to SSRF and potential XSS GSA_kwCzR0hTQS1xY3ByLTY3OXEtcmhtMs4ABN8I

npm astro
Moderate
10 months ago

Astro's `X-Forwarded-Host` is reflected without validation GSA_kwCzR0hTQS01ZmY1LTlmY3ctdmc4OM4ABNQ_

npm astro
Potential
High
12 months ago

Server-Side Request Forgery via /_image endpoint in Astro Cloudflare adapter GSA_kwCzR0hTQS1xcHI0LWMzMzktN3ZxOM4ABLqn

npm @astrojs/cloudflare
Moderate
12 months ago

Astro allows unauthorized third-party images in _image endpoint GSA_kwCzR0hTQS14Zjh4LWo0cDItZjc0Oc4ABLM1

npm astro, @astrojs/node
Potential
Moderate
about 1 year ago

@astrojs/node's trailing slash handling causes open redirect issue GSA_kwCzR0hTQS05eDljLWdoYzUtamh3Oc4ABLJE

npm @astrojs/node
Moderate
about 1 year ago

Astros's duplicate trailing slash feature leads to an open redirection security issue GSA_kwCzR0hTQS1jcThjLXh2NjYtMzZnd84ABK2p

npm astro
High
over 1 year ago

Astro's server source code is exposed to the public if sourcemaps are enabled GSA_kwCzR0hTQS00OXc2LTczY3ctY2hqcs4ABCoF

npm astro
Moderate
over 1 year ago

Atro CSRF Middleware Bypass (security.checkOrigin) GSA_kwCzR0hTQS1jNHB3LTMzaDMtMzV4d84ABCjF

npm astro
Moderate
almost 2 years ago

DOM Clobbering Gadget found in astro's client-side router that leads to XSS GSA_kwCzR0hTQS1tODV3LTNoOTUtaGNmOc4ABAQP

npm astro

Filter by Severity

Moderate 15 High 7 Low 5