astro

Security advisories

Grouped by the version that fixes them, so one upgrade reads as one step.

• Fixed in 7.2.8 · 1 advisory

  • CRITICALAstro: Remote code execution through AVIF image optimizationGHSA-26w7-cxv4-gfx2

• Fixed in 7.2.4 · 1 advisory

  • MODERATEAstro: Authorization bypass from missing path-segment boundary check when stripping the configured baseGHSA-376h-93r7-7g6f

• Fixed in 7.1.0 · 1 advisory

  • MODERATEAstro: Reflected XSS via unescaped View Transition animation propertiesGHSA-4g3v-8h47-v7g6

• Fixed in 7.0.6 · 2 advisories

  • MODERATEAstro: composable `astro/hono` pipeline bypasses `security.checkOrigin` when `middleware()` is absent or misorderedGHSA-8mv7-9c27-98vc
  • MODERATEAstro: XSS via unescaped spread attribute names in renderHTMLElement (incomplete fix for CVE-2026-54298)GHSA-f48w-9m4c-m7f5

Every stable release, newest first. Notes are quoted as the maintainers published them.

1. 7.4.1

   19 October 2026
   Preserves the last modified date of cached optimized images and incrementally restored build output when copying them into the build output on all platforms

   Patch Changes

   • Preserves the last modified date of cached optimized images and incrementally restored build output when copying them into the build output on all platforms

   • Fixes a typo in the error message shown when a font cssVariable is invalid

   • Fixes a bug where projects whose path contains an apostrophe (') failed to load sessions, middleware, a cache provider, or a src/fetch.ts handler

   • Fixes a TSCONFIG_ERROR during astro build when a parent directory contains a tsconfig.json that cannot be resolved, such as one extending astro/tsconfigs/strict without installed dependencies

   • Fixes an Unterminated string build error when application code imports from astro/config (for example, fontProviders in a shared fonts module)

   • Fixes missing styles in production builds for conditionally rendered framework components (e.g. Svelte components inside {#if} blocks) imported by a hydrated island

   • Fixes style-only HMR in .astro components falling back to a full page reload when a PostCSS plugin (such as @unocss/postcss) lists the component as a dependency of its own style

   • Fixes increasing memory usage when editing the Astro configuration while the dev server is running

2. 7.4.0

   15 October 2026
   Adds a new --timings flag to astro build to help you find what slows down your buildsWhen a build takes longer than expected, it can be hard to tell whether the cause is an integration, a Markdown processor plugin, image processing, or even syntax highlighting. Add the --timings flag to your build command to print a summary once the build finishes:astro build --timingsThis is helpful to decide what to optimize first, or to compare build times before and after a change to your project.

   Minor Changes

   • Adds a new --timings flag to astro build to help you find what slows down your builds

     When a build takes longer than expected, it can be hard to tell whether the cause is an integration, a Markdown processor plugin, image processing, or even syntax highlighting. Add the --timings flag to your build command to print a summary once the build finishes:

     astro build --timings

     This is helpful to decide what to optimize first, or to compare build times before and after a change to your project.

   • Adds a new optional getFontProperties() callback to font providers

     Font providers can now expose the weights, styles, subsets and formats a font family actually has. Astro uses it when resolving your font configuration to warn about values a provider cannot serve, for example a weight a font family does not offer.

     All built-in providers implement it. If you maintain a custom font provider, implementing this callback is optional for now but it will be required in Astro 8:

     import type { FontProvider } from 'astro';
     
     const provider: FontProvider = {
         name: 'my-provider',
         resolveFont: ({ familyName }) => {
             // ...
         },
         getFontProperties: ({ familyName }) => ({
             weights: ['400', '700'],
             styles: ['normal', 'italic'],
             subsets: ['latin'],
             formats: ['woff2'],
         }),
     };

   • Adds a fetch() function to the font provider init() context

     This function requests a provider API, retrying transient failures and more. It lets providers that wrap a 3rd-party unifont provider pass the context to it directly:

     import type { FontProvider } from 'astro';
     import type { InitializedProvider } from 'unifont';
     import { acmeProvider } from '@acme/unifont-provider';
     
     export function acmeFontProvider(): FontProvider {
         const provider = acmeProvider();
         let initializedProvider: InitializedProvider | undefined;
         return {
             name: provider._name,
             async init(context) {
                 initializedProvider = await provider(context);
             },
             // ...
         };
     }

   • Adds experimental.redirectPage, letting you provide your own src/pages/3xx.astro in place of the redirect page Astro generates in static builds.

     A static site has no server to send an HTTP Location header, so Astro generates a small HTML page with a <meta http-equiv="refresh"> tag for each redirect it builds:

     • Your redirects entries

     • Astro.redirect() calls in prerendered pages

     • i18n redirects

     That page's markup, wording, and refresh delay were fixed, so you could not brand or translate it.

     To enable this feature, add the experimental flag to your Astro config:

     // astro.config.mjs
     import { defineConfig } from 'astro/config';
     
     export default defineConfig({
       experimental: {
         redirectPage: true,
       },
     });

     Then create src/pages/3xx.astro. Astro renders it once per redirect, passing that redirect's details as props:

     ---
     // src/pages/3xx.astro
     import type { RedirectPageProps as Props } from 'astro';
     
     const { from, to, status, delay } = Astro.props;
     ---
     
     <html lang="en">
       <head>
         <meta http-equiv="refresh" content={`${delay};url=${to}`} />
         <meta name="robots" content="noindex" />
         <title>Redirecting…</title>
       </head>
       <body>
         <p>This page has moved. <a href={to}>Continue to {to}</a>.</p>
       </body>
     </html>

     Your page must render a <meta http-equiv="refresh"> tag pointing at to, because in a static build that tag is the redirect. Astro logs a warning during the build if it is missing.

     See the experimental redirect page documentation for more information.

   • Adds a notFound() handler to astro/fetch and astro/hono that renders the custom 404 page when no route matches, including a prerendered 404.astro

     Add it before pages() in a custom worker or server entrypoint that does not run inside App.render, such as a Hono app used directly as a Cloudflare worker. Without it, pages() and middleware() return an empty 404 with an internal X-Astro-Error header for unmatched routes. astro() already includes this handling.

     import { Hono } from 'hono';
     import { notFound, pages } from 'astro/hono';
     import { cf } from '@astrojs/cloudflare/hono';
     
     const app = new Hono();
     app.use(cf());
     app.use(notFound());
     app.use(pages());
     export default app;

   • Adds support for separate build and runtime image services

     image.service now also accepts a build and a runtime service. The build service optimizes images on prerendered pages when you build your site, and is also used during development. The runtime service handles images on on-demand rendered pages and the image endpoint of your deployed site.

     The following example uses Sharp to optimize images on prerendered pages, and an image CDN for on-demand rendered pages:

     // astro.config.mjs
     import { defineConfig } from 'astro/config';
     
     export default defineConfig({
       image: {
         service: {
           build: { entrypoint: 'astro/assets/services/sharp' },
           runtime: { entrypoint: 'my-image-cdn-service' },
         },
       },
     });

   Changes for integration authors

   config.image.service keeps the shape the user configured it with. When a project sets build and runtime services, config.image.service.entrypoint and config.image.service.config are undefined.

   If your integration reads image.service, check for the runtime property to get the service you need:

   'astro:config:done': ({ config }) => {
     const { service } = config.image;
     const runtimeService = 'runtime' in service ? service.runtime : service;
   
     if (runtimeService.entrypoint === 'astro/assets/services/sharp') {
       // ...
     }
   },

   Setting image.service with updateConfig() replaces the existing service instead of merging with it when the two use different shapes. For example, setting a single service in a project that uses build and runtime services replaces both.

   • Increases the minimum Node.js version to 22.22.0

     The minimum supported Node.js version is now 22.22.0, the latest Node.js 22 release supported by StackBlitz. This change is in line with Astro's Node.js support policy.

   • Allows integrations to control where Astro writes client, server, and prerender build output.

     Custom prerenderers can access the final output locations through the new outputDirectories context:

     setPrerenderer((defaultPrerenderer, { outputDirectories }) => {
       const { client, server, prerender } = outputDirectories
     
       return createPrerenderer({
         defaultPrerenderer,
         client,
         server,
         prerender,
       })
     })

   • Lets custom prerenderers report the images used on prerendered pages

     Astro now generates images on prerendered pages from the image information that a prerenderer's getStaticPaths() and render() return. If your prerenderer wraps Astro's default one, pass this information through:

     setPrerenderer((defaultPrerenderer) => ({
       name: 'my-prerenderer',
       async setup() {
         await defaultPrerenderer.setup?.();
       },
       async getStaticPaths() {
         const result = await defaultPrerenderer.getStaticPaths();
         const { paths, metadata } = Array.isArray(result) ? { paths: result } : result;
         return { paths: paths.filter(({ pathname }) => !pathname.startsWith('/drafts')), metadata };
       },
       render(request, options) {
         return defaultPrerenderer.render(request, options);
       },
       async teardown() {
         await defaultPrerenderer.teardown?.();
       },
     }));

     Returning a plain array from getStaticPaths() or a plain Response from render() still works, but is deprecated: images used on those pages are not generated.

   • Adds support for experimental parallel prerendering

     This experimental feature makes astro build render your static pages in parallel, using multiple CPU cores at once instead of one. On sites with many pages, this can significantly reduce build times, at the cost of higher memory usage.

     To enable this feature, add the experimental flag in your Astro config:

     // astro.config.mjs
     import { defineConfig } from 'astro/config';
     
     export default defineConfig({
       experimental: {
         parallelPrerender: true,
       },
     });

     By default, Astro uses all available CPU cores but one. Each additional worker increases the memory used by your build. If your build runs out of memory, or does not get faster, set workers to a lower number:

     // astro.config.mjs
     import { defineConfig } from 'astro/config';
     
     export default defineConfig({
       experimental: {
         parallelPrerender: {
           workers: 4,
         },
       },
     });

     Each worker renders as many pages at once as your build.concurrency setting allows.

     This feature has no effect when your adapter provides its own way of prerendering pages. Among official adapters, this only applies to @astrojs/cloudflare. Astro logs a warning during the build when the flag is ignored.

     For more information on enabling and using this feature in your project, see the experimental parallel prerendering docs.

   Patch Changes

   • Fixes deployment integrations being unable to use Vite manifests when preparing build output

   • Fixes the JSDoc for CSP utilities to point to the render context reference in docs.

   • Replaces internal use of find-proc with tinyps.

   • Fixes prerender errors being silently swallowed when using a custom src/fetch.ts with an adapter that prerenders in its own runtime, such as @astrojs/cloudflare. Previously, a page that threw during prerendering was written as an empty HTML file and the build succeeded. The build now fails with the underlying error.

   • Fixes original images being kept despite only width or height being read.

   • Fixes glob() loader swallowing rendering errors during content sync, which allowed astro build to exit successfully (code 0) even when a remark/rehype plugin threw an error

   • Fixes the sync command description in astro help, which only mentioned content collections.

3. 7.3.8

   8 October 2026
   Fixes Astro.cache being undefined when a custom 404 or 500 page is rendered by the error handler, for example after a request to an API route with an HTTP method the route doesn't export

   Patch Changes

   • Fixes Astro.cache being undefined when a custom 404 or 500 page is rendered by the error handler, for example after a request to an API route with an HTTP method the route doesn't export

   • Fixes astro add removing existing allowBuilds approvals from pnpm-workspace.yaml with pnpm v11.0–v11.22

   • Refactors internal bundling and code transforms to use Vite's Oxc-based transformWithOxc and Rolldown instead of esbuild. These packages no longer depend on esbuild directly.

   • Fixes the glob() loader not reloading changed files in dev when the pattern starts with an extglob such as !(drafts)/**/*.md

4. 7.3.7

   7 October 2026
   Fixes a build error when a Markdown content collection entry loaded with glob({ deferRender: true }) has a layout frontmatter property. layout is now ignored for content collection entries, as documented.

   Patch Changes

   • Fixes a build error when a Markdown content collection entry loaded with glob({ deferRender: true }) has a layout frontmatter property. layout is now ignored for content collection entries, as documented.

   • Fixes astro add cloudflare failing to install dependencies with pnpm v11+ by approving the workerd build script, and shows the package manager's error output when astro add fails to install dependencies

   • Fixes an issue where AVIF images were served as image/heif instead of image/avif in the dev server.

   • Fixes the cache() handler from astro/hono and astro/fetch throwing a TypeError when a cache provider is configured. It now registers the cache provider before rendering, so Astro.cache is available to downstream handlers like pages().

   • Fixes security.checkOrigin rejecting cross-origin requests with non-form content types such as application/json. As documented, the check only applies to unsafe requests that have no content-type header or one of application/x-www-form-urlencoded, multipart/form-data, or text/plain.

5. 7.3.6

   6 October 2026
   Fixes an intermittent dev server crash when using astro:actions inside a server island with adapters that use a pre-bundled SSR environment (e.g. @astrojs/cloudflare)

   Patch Changes

   • Fixes an intermittent dev server crash when using astro:actions inside a server island with adapters that use a pre-bundled SSR environment (e.g. @astrojs/cloudflare)

   • Fixes stale scoped styles during HMR when both markup and <style> are changed in a single save

   • Fixes CSS from other pages leaking into a page's <head> in dev when the page imports a module such as astro:config/server.

   • Fixes a bug where server islands containing framework components rendered empty in the dev server when using a custom src/fetch.ts

   • Fixes the composable i18n() handler from astro/fetch and astro/hono returning an empty 404 for paths without a locale prefix. It now renders the custom 404 page, matching astro().

   • Fixes CSS Module HMR in dev when a component is rendered both with and without hydration on the same page. Astro now uses path-based class name hashing in dev mode so that editing CSS declarations no longer changes the generated selectors, allowing Vite's CSS HMR to update styles without a full page reload.

   • Fixes context.props being null in middleware and endpoints when the composable astro/hono or astro/fetch actions() handler runs before middleware(), or when pages() runs without middleware()

   • Fixes astro build failing on Windows with Node.js 25+ with ERR_INVALID_ARG_VALUE when clearing the output directory hits a transient EPERM error

   • Fixes type errors reported in Astro's built-in <Picture /> and <Font /> components when type-checking a project with tsc and @astrojs/ts-content-mapper

   • Fixes lost request state when Vite discovers server dependencies during a request in Cloudflare dev mode

   • Fixes CSS imported from an injectScript('page') script being dropped during build

   • Fixes a hang when a server:defer component is inside a slot of another component in an MDX content collection entry

   • Fixes the glob() loader skipping content files whose paths contain # or ?

   • Fixes a bug where page routes added with injectRoute() returned a 404 when i18n.routing.prefixDefaultLocale was true and the route path had no locale prefix

   • Fixes content collection changes being ignored in astro dev after the dev server restarts because of a config change

   • Fixes Astro.cookies.get() returning undefined for request cookies with empty values

   • Fixes nondeterministic ordering of the server manifest's assets array, ensuring builds with identical inputs produce byte-identical output

   • Adds YAML parsing with timestamp and merge key support, and formats YAML errors consistently across Astro, Markdown, MDX, and Markdoc.

   • Improves CSRF protection by taking modern browsers headers into account

   • Fixes a runtime ReferenceError for inlined scripts that import a URL with /* @vite-ignore */.

     Astro now inlines scripts after Vite replaces its preload markers, so ignored dynamic imports can remain inline without shipping an unresolved __VITE_PRELOAD__ reference.

   • Fixes custom View Transition direction names that are not valid CSS identifiers, such as names starting with a digit or containing spaces. These directions now match their animations correctly.

   • Fixes a 404 for a CSS file that a dynamic import preloads when the imported module uses a component that is also a hydrated island on the same page

   • Fixes duplicate CSS in production builds when a component is both server-rendered and used with client:only on the same page

   • Fixes the composable astro/fetch and astro/hono handlers (trailingSlash(), redirects(), actions(), middleware(), and pages()) so they reject over-encoded request paths with a 400 Bad Request, matching astro(). For these requests, redirects() and actions() return the 400 response instead of undefined, so no redirect is issued and no action runs.

   • Fixes Astro.rewrite() and context.rewrite() selecting the wrong route in astro dev when two dynamic routes match the same path

   • Allows Astro CLI commands to install tagged package versions

   • Fixes a dev server dependency scan failure when an .astro file contains a literal <script in frontmatter or a template expression

   • Fixes Astro on StackBlitz and other WebContainer environments

   • Fixes a MODULE_LEVEL_DIRECTIVE warning during build caused by a stale "use astro:head-inject" directive in content collection propagated asset modules

6. 7.3.5

   24 September 2026
   Adds a new container function called renderComponent(), which renders Astro components with inlined styles and scripts.Users must import the component with the new ?container query string:import { experimental_AstroContainer } from "astro/container";

   Patch Changes

   • Adds a new container function called renderComponent(), which renders Astro components with inlined styles and scripts.

     Users must import the component with the new ?container query string:

     import { experimental_AstroContainer } from "astro/container";
     import TodoList from "../components/TodoList.astro?container";
     
     const container = await experimental_AstroContainer.create();
     
     const _string = container.renderComponent(TodoList);

7. 7.3.4

   22 September 2026
   Fixes incremental builds repeatedly rendering unchanged pages when modules or compiled CSS reference bundled assets.

   Patch Changes

   • Fixes incremental builds repeatedly rendering unchanged pages when modules or compiled CSS reference bundled assets.

   • Improves the astro check error shown for TypeScript 7. The command now explains that TypeScript 7 is not currently supported and provides instructions for experimentally type-checking Astro files with TypeScript 7.1 and @astrojs/ts-content-mapper.

   • Fix double-escaped ampersands in Markdown image alt and title attributes. The __ASTRO_IMAGE_ round-trip now decodes the numeric (&) and named (&) character references the Markdown processors emit, so an & in an alt or title is escaped exactly once in the final HTML instead of twice.

   • Fix three error names that did not match their documented reference. MissingLocale, MissingIndexForInternationalization and NoManifestAvailable reported names ending in Error in the dev overlay, while their error reference pages are published under the unsuffixed names, so the name shown to users could not be found in the docs.

   • Fixes the dev server re-evaluating the whole server module graph on every request. The astro:head-metadata plugin invalidated its component metadata virtual module from its own transform hook, so each evaluation of that module scheduled the next one. Adapters that run requests outside Vite's module runner, such as @astrojs/cloudflare, paid for a full re-evaluation of the server graph on every request for the lifetime of the process.

   • Fixes domain-based i18n routing to respect security.allowedDomains when selecting a locale from request host headers

   • Fixes image.responsiveStyles emitting invalid object-position CSS values for same-axis keyword pairs (top bottom, left right, etc.)

   • Runs astro dev and astro preview in the foreground when an AI agent is detected on Windows, allowing the agent to manage the process lifetime. Pass --background explicitly to request an Astro-managed background process. Agent-inferred backgrounding remains enabled on other platforms.

8. 7.3.3

   16 September 2026
   Refactors internal version handling to use a smaller, ESM-native dependency

   Patch Changes

   • Refactors internal version handling to use a smaller, ESM-native dependency

   • Returns appropriate 400 and 404 responses from the image endpoint for invalid and missing local image paths

   • Fixes Astro.preferredLocaleList returning an empty list when a locale is configured with the object form ({ path, codes }) and the browser sends the code with different casing or an underscore, such as en-US matching a configured en-us

   • Fixes astro preview --ignore-lock (and astro dev --ignore-lock) being refused when run from an AI agent environment. The flag now starts the server in the foreground instead of erroring, since agent detection only inferred background mode and was never explicitly requested. An explicit --background combined with --ignore-lock still errors.

   • Fixes TypeScript autocompletion for getImage() to suggest all available predefined options.

   • Fixes a type error in getImage() options that allowed passing both widths and densities at the same time.

   • Improves rendering performance

   • Fixes a WebAssembly error when importing astro:actions in tests that run under @cloudflare/vitest-pool-workers

   • Fixes trailing-slash redirect response body pointing to the incoming URL instead of the redirect target. The location header was correct, but the HTML body (<meta http-equiv="refresh">, <title>, and <a> tag) contained the original request path without the trailing-slash correction or query string.

   • Fixes custom dev toolbar apps losing their UI after client-side navigation with <ClientRouter />.

   • Fixes prerendered Cloudflare pages rendering as [object Object] when nodejs_compat is enabled in wrangler.toml

   • Fixes a regression in astro dev where writes outside the module graph (for example, @astrojs/cloudflare's .wrangler/state files) invalidated the middleware on every request, causing repeated SSR reloads. Such writes no longer invalidate the middleware.

   • security

     Updates svgo to 4.0.2 to resolve a security advisory

   • Fixes a one-time page reload shortly after the first load on cold dev-server starts when a project has framework components imported from MDX content entries. MDX files are now included in the dev dependency pre-bundling scan, so their framework dependencies are bundled up front instead of being discovered (and reloaded for) at runtime.

   • Improves dev server startup time. The content config and dev server app module graphs now begin compiling during server creation without blocking the server from listening. Request handling waits for the shared setup result when needed, cutting astro dev ready time by roughly a third on projects with a content config.

   • Improves the diagnostics of some Astro errors.

   • Fixes SVG <style> elements nested inside <defs> or other container elements not being hashed for CSP

   • Fixes experimental.incrementalBuild restoring pages with stale CSS after a preprocessor partial changes or missing original images referenced by restored pages

   • Fixes a bug where the dev server stripped the configured base from URLs that only share a prefix with it. With base: '/s', requests to /src/... were rewritten to /rc/... and failed, breaking those pages during development.

   • cfccafa Thanks @gameroman! - Improves JSDoc for fonts api

   • Fixes CSS HMR for framework components rendered through content entries after ClientRouter navigation

   • Improves serialization of transition animation values in generated CSS

   • Fixes content collection HMR not updating prerendered pages when an adapter enables a separate prerender environment (e.g. @astrojs/cloudflare with prerenderEnvironment: 'node')

   • Fixes redirect targets being corrupted when a dynamic route parameter value contains $ replacement patterns like $&

   • Fixes a bug where the glob() content loader kept stale entries in the data store after the last file in a collection was deleted. Empty collections are now pruned correctly, and the file watcher is registered in dev so the first file added to an empty collection is picked up without a restart.

   • Pre-bundles renderer server entrypoints and the default console logger during dev so they are included in the initial optimization pass, preventing a mid-request re-optimization that could crash the dev server on Cloudflare (workerd).

9. 7.3.2

   8 September 2026
   Fixes / rendering in MDX so that only literal content (including content injected by remark/rehype plugins) is treated as trusted markup. A dynamic value passed as a / child (e.g. {value}) is now escaped like any other element's content instead of being rendered raw. Use set:html to explicitly opt a dynamic value back into raw rendering.

   Patch Changes

   • Fixes <script>/<style> rendering in MDX so that only literal content (including content injected by remark/rehype plugins) is treated as trusted markup. A dynamic value passed as a <script>/<style> child (e.g. <script>{value}</script>) is now escaped like any other element's content instead of being rendered raw. Use set:html to explicitly opt a dynamic value back into raw rendering.

   • Fixes the dev toolbar returning a 504 "Outdated Optimize Dep" error when a workspace-linked package imports a dependency that Vite's initial scan did not discover

   • Fixes i18n fallback routing replacing the first substring match instead of the actual locale segment, which mangled paths like /energy/en/about into /esergy/en/about

   • Fixes sessions breaking in dev mode with the Cloudflare adapter when middleware is present

10. 7.3.1

    3 September 2026
    Fixes an error that prevented projects using astro:assets from starting or building

    Patch Changes

    • Fixes an error that prevented projects using astro:assets from starting or building

Major versions

• 7.xsince 22 June 2026 · latest 7.4.1 · 39 releases
• 6.xsince 10 March 2026 · latest 6.4.8 · 41 releases
• 5.xsince 3 December 2024 · latest 5.18.2 · 137 releases
• 4.xsince 5 December 2023 · latest 4.16.19 · 145 releases
• 3.xsince 30 August 2023 · latest 3.6.5 · 48 releases
• 2.xsince 24 January 2023 · latest 2.10.15 · 93 releases
• 1.xsince 9 August 2022 · latest 1.9.2 · 65 releases
• 0.xsince 12 March 2021 · latest 0.26.1 · 162 releases