Astro vulnerabilities

Astro is a web framework for content-driven websites. Prior to 7.3.2, Astro's JSX and MDX rendering pipeline treats string children of script and style elements as trusted HTML without distinguishing compiler-generated literal content from dynamic expression values, allowing injection of arbitrary HTML and JavaScript. The issue is limited to script and style children rendered through the astro:jsx renderer, including MDX components, and can produce reflected or stored cross-site scripting under the application's origin.

In Astro from 7.1.0 until 7.3.3, the server-side View Transition CSS generator does not keep string animation properties within their generated declarations. An application passing attacker-controlled data into properties such as duration, delay, easing, direction, fillMode, or animation names can allow CSS delimiters to terminate the declaration and add attacker-selected rules to the server-rendered page. The injected CSS can conceal or reposition content, add generated text, and otherwise misrepresent the interface. This is fixed in 7.3.3.

Astro is a web framework for content-driven websites. Prior to version 11.1.3, the @astrojs/node adapter builds a request URL from the Host header, and a malformed port can make that URL invalid. The recovery path reuses the same malformed host and throws an uncaught TypeError: Invalid URL before routing begins. In the default standalone configuration, the request returns an HTTP 500 response and the server continues running, but when staticHeaders is enabled the synchronous handler does not catch the exception and the Node process terminates. Proxies and CDNs that reject malformed Host headers prevent this path from reaching the origin. The issue affects availability only and does not expose data or permit code execution. This issue is fixed in version 11.1.3.

Astro from 5.2.0 to 8.2.4 has a vulnerability in the @astrojs/netlify adapter that generates regexes for Netlify Image CDN remote-image allowlists without anchoring them to the URL start. This allows an attacker to control the actual host while an allowed origin appears only in the path or query. An unauthenticated request to /.netlify/images can cause the Image CDN to request attacker-selected URLs, potentially probing internal services. Fixed in version 8.2.4.

Astro is a web framework for content-driven websites. Prior to 7.2.4, Astro stripped a configured non-root base path from request pathnames using a string-prefix check without verifying a path-segment boundary. With base "/app", a request to "/appX/admin" resolved internally to the protected "/admin" route while middleware observed "/appX/admin" in context.url.pathname. In applications that authorize base-prefixed routes by inspecting context.url.pathname, an unauthenticated remote attacker could bypass pathname-based middleware authorization and reach protected routes. This issue is fixed in version 7.2.4.

Astro from 10.0.3 until 11.0.3 has a vulnerability in the Vercel adapter where the public /_isr function accepts x_astro_path based only on the x-vercel-isr header, allowing unauthenticated GET requests to render routes protected only by Vercel edge path rules or split edge middleware.

Astro prior to 8.1.2, the Netlify adapter converts each image.remotePatterns entry into a regular expression written to .netlify/v1/config.json under images.remote_images for Netlify's Image CDN allowlist. In packages/integrations/netlify/src/index.ts, remotePatternToRegex() escapes dots in hostname values but interpolates literal pathname values without escaping regular expression metacharacters such as ., +, ?, (, and [, so a restrictive pathname such as /img/v1.0/file also matches metacharacter-adjacent paths, including paths that cross a segment. Netlify enforces the generated regular expression directly and Astro's matchPattern() helper does not revalidate the request, allowing optimization of images on an already-allowed host that the declared pathname was intended to exclude. This issue is fixed in version 8.1.2.

Astro is a web framework for content-driven websites. From 7.0.0 until 7.0.6, the composable astro/hono pipeline installs security.checkOrigin only through the middleware() primitive, while actions() and pages() can dispatch to user code independently. Mounting actions() before middleware(), as in the examples/advanced-routing example and Cloudflare Hono documentation, allows cross-origin form-encoded action requests to execute before the origin check, and using pages() without middleware() drops the check for on-demand endpoints and pages. The flaw enables blind write-only cross-site request forgery using the victim's cookies against ActionHandler.handle and PagesHandler.handleWithErrorFallback when manifest.checkOrigin is enabled; the attacker can trigger a state-mutating action or endpoint handler but cannot read the cross-origin response. The default non-composable astro() pipeline is not affected. This issue is fixed in version 7.0.6.

Astro is a web framework for content-driven websites. From 2.9.0 until 7.1.0, Astro's server-side View Transition CSS generator interpolates animation properties into an inline style element without escaping them for CSS and HTML contexts. An attacker-controlled View Transition animation value such as duration can terminate the generated style element and inject arbitrary HTML or JavaScript. The affected code is packages/astro/src/runtime/server/transition.ts; renderTransition passes sheet.toString() into markHTMLString(), while addAnimationProperty serializes duration through toTimeValue() and also handles easing, direction, delay, fillMode, and name. Exploitation requires an on-demand or server-rendered route to pass attacker-controlled data into a View Transition animation definition and can execute arbitrary JavaScript in the affected application's origin, allowing access to sensitive page data and authenticated actions available to the victim. This issue is fixed in version 7.1.0.

In Astro versions 8.1.0 through 11.0.1, when trailingSlash: 'always' is configured, the @astrojs/node standalone server's static file handler appends a trailing slash to request paths and issues a 301 redirect. Paths beginning with /\ (slash-backslash) were not recognized as internal paths, so the handler would echo the raw path back in the Location header. Because browsers treat \ as / per the WHATWG URL specification, the resulting redirect could resolve to an external host.

Astro versions 1.0.0 through 4.0.18 have a vulnerability where source.title and enclosure.type fields in the RSS generator are not XML-escaped. An attacker controlling these values can inject arbitrary XML into the RSS feed, leading to fake metadata, malicious redirects, or misparsing by feed readers. In SSR mode, the poisoned feed is served to all subscribers. Fixed in version 4.0.19.

Astro is a web framework for content-driven websites. Versions prior to 7.0.6 are vulnerable to XSS through unescaped spread attribute names in renderHTMLElement. The fix for CVE-2026-54298 added an INVALID_ATTR_NAME_CHAR guard to addAttribute(), but a second attribute-rendering path, renderHTMLElement(), was not updated and interpolates the attribute name unescaped, allowing XSS. This issue has been fixed in version 7.0.6.

In Astro versions 3.10.0 through 7.0.3, when a transition:persist, transition:scope, or transition:persist-props directive is applied to a client-hydrated (client:*) component, Astro copied the directive value onto the rendered <astro-island> element without HTML-escaping it. If a developer reflects attacker-controlled input into one of these directives, an attacker can break out of the attribute and inject arbitrary HTML/JavaScript into the server-rendered output, resulting in reflected cross-site scripting (XSS).

Astro version 6.4.7 performs authorization decisions on a partially decoded pathname after reaching the iterative URL decoder limit, while later rewrite route matching performs an additional decodeURI() operation, potentially allowing bypass of access controls to protected routes.

Astro prior to 6.1.10 used AES-GCM encryption for server island props and slots but did not bind ciphertext to its intended component or parameter type. An attacker could replay one component's encrypted props (p) as another component's slots (s) or vice versa; since slots contain raw unescaped HTML, this could lead to XSS. This occurs when the app uses server islands, two components share the same key name for a prop and a slot, and the attacker controls the overlapping prop value.

In Astro prior to 6.1.6, the defineScriptVars function in the server-side rendering pipeline uses a case-sensitive regex /<\/script>/g to sanitize values injected into inline <script> tags via the define:vars directive. HTML parsers close <script> elements case-insensitively and also accept whitespace or / before the closing >, allowing an attacker to bypass sanitization with payloads like </Script>, </script >, or </script/> and inject arbitrary HTML/JavaScript. This vulnerability is fixed in 6.1.6.

Astro is a web framework. Versions 5.15.7 and below have a double URL encoding bypass which allows any unauthenticated attacker to bypass path-based authentication checks in Astro middleware, granting unauthorized access to protected routes. While the original CVE-2025-64765 was fixed in v5.15.8, the fix is insufficient as it only decodes once, so attackers can still bypass authentication using double-encoded URLs.

Astro is a web framework. Prior to version 5.15.9, when using Astro's Cloudflare adapter (@astrojs/cloudflare) with output: 'server', the image optimization endpoint (/_image) contains a critical vulnerability in the isRemoteAllowed() function that unconditionally allows data: protocol URLs. This enables Cross-Site Scripting (XSS) attacks through malicious SVG payloads, bypassing domain restrictions and Content Security Policy protections.

Prior to Astro 5.15.8, a mismatch exists between how Astro normalizes request paths for routing and how middleware reads the path for validation. Astro applies decodeURI() while middleware uses context.url.pathname without normalization, potentially allowing bypass of validation checks.

Prior to version 5.15.8, the Astro web framework contains a reflected XSS vulnerability when the server islands feature is used in the targeted application, regardless of the component templates' intent. This issue has been patched in version 5.15.8.

Astro is a web framework. Prior to version 5.14.3, a vulnerability has been identified in the Astro development server that allows arbitrary local file read access through the image optimization endpoint. The vulnerability affects Astro development environments and allows remote attackers to read any image file accessible to the Node.js process on the host system. This issue has been patched in version 5.14.3.

A Reflected Cross-Site Scripting (XSS) vulnerability exists in Astro's development server error pages when the `trailingSlash` configuration option is used. An attacker can inject arbitrary JavaScript that executes in the victim's browser context via a crafted URL. The issue only affects the development server, not production builds, and is fixed in version 5.15.6.

Astro is a web framework. In Astro versions 2.16.0 up to but excluding 5.15.5 which utilize on-demand rendering, request headers x-forwarded-proto and x-forwarded-port are insecurely used without sanitization to build the URL. This leads to middleware-based protected route bypass, DoS via cache poisoning, SSRF, URL pollution (potential SXSS), and WAF bypass. Version 5.15.5 contains a patch.

Astro is a web framework with an image proxy. In versions 5.13.4 to 5.13.10, the image proxy domain validation can be bypassed using backslashes in the href parameter, allowing server-side requests to arbitrary URLs. This can lead to SSRF and potentially XSS. Due to incomplete fix for CVE-2025-58179. Fixed in 5.13.10.

Astro is a web framework. Prior to version 5.14.2, Astro reflects the value in X-Forwarded-Host in output when using Astro.url without validation, allowing a malicious request to manipulate this value. This could lead to redirection to a malicious site or capture of login credentials, especially in setups with a caching proxy. Version 5.14.2 contains a fix.