Packages / astro / Security

LowVulnerabilityGHSA-g735-7g2w-hh3fPublished 26 Mar 2026

Astro: Remote allowlist bypass via unanchored matchPathname wildcard

Affected · astro

  • >= 2.10.10, < 5.18.1

Fixed in

5.18.1

npm install astro@5.18.1

  1. Not affected

    0.0.1 – 2.10.9

    314 releases

  2. Affected

    2.10.10 – 5.18.0

    334 releases

  3. Fixed

    5.18.1 – 7.4.1

    82 releases, latest

730 stable releases of astro, oldest to newest.

What happens

The full text is not stored yet. Read it on osv.dev.