Packages

astro

7.4.1 · 19 Oct 2026MIT4.8M / weekRepositoryHomepagenpmAtom feed

Security advisories

From OSV. Open ones first, then the most severe. "Fixed in" is read against the latest release, 7.4.1.

SeverityAdvisoryAffectedFixed in
CriticalAstro: Remote code execution through AVIF image optimizationGHSA-26w7-cxv4-gfx2 · 8 Sept 2026< 7.2.87.2.8
HighAstro: Authorization Bypass via Decode Iteration Limit and Rewrite Path Canonicalization MismatchGHSA-vj59-8hwv-xxmv · 20 Jul 2026>= 6.4.7, < 6.4.86.4.8
HighAstro: Host header SSRF in prerendered error page fetchGHSA-2pvr-wf23-7pc7 · 16 Jun 2026< 6.4.66.4.6
HighAstro: Reflected XSS via unescaped slot nameGHSA-8hv8-536x-4wqp · 16 Jun 2026< 6.3.36.3.3
HighAstro vulnerable to reflected XSS via the server islands featureGHSA-wrwg-2hg8-v723 · 19 Nov 2025< 5.15.85.15.8
HighAstro's bypass of image proxy domain validation leads to SSRF and potential XSSGHSA-qcpr-679q-rhm2 · 28 Oct 2025>= 5.13.4, < 5.13.105.13.10
HighAstro's server source code is exposed to the public if sourcemaps are enabledGHSA-49w6-73cw-chjr · 19 Dec 2024>= 5.0.0-alpha.0, < 5.0.8 · < 4.16.185.0.8
ModerateAstro: Authorization bypass from missing path-segment boundary check when stripping the configured baseGHSA-376h-93r7-7g6f · 8 Sept 2026< 7.2.47.2.4
ModerateAstro: composable `astro/hono` pipeline bypasses `security.checkOrigin` when `middleware()` is absent or misorderedGHSA-8mv7-9c27-98vc · 20 Jul 2026>= 7.0.0, < 7.0.67.0.6
ModerateAstro: XSS via unescaped spread attribute names in renderHTMLElement (incomplete fix for CVE-2026-54298)GHSA-f48w-9m4c-m7f5 · 20 Jul 2026< 7.0.67.0.6
ModerateAstro: Reflected XSS via unescaped View Transition animation propertiesGHSA-4g3v-8h47-v7g6 · 20 Jul 2026>= 2.9.0, < 7.1.07.1.0
ModerateAstro: XSS via Unescaped Attribute Names in Spread PropsGHSA-jrpj-wcv7-9fh9 · 16 Jun 2026< 6.4.66.4.6
ModerateAstro: XSS in define:vars via incomplete </script> tag sanitizationGHSA-j687-52p2-xcff · 21 Apr 2026< 6.1.66.1.6
ModerateAstro has an Authentication Bypass via Double URL Encoding, a bypass for CVE-2025-64765GHSA-whqg-ppgf-wp8c · 8 Dec 2025< 5.15.85.15.8
ModerateAstro Cloudflare adapter has Stored Cross-site Scripting vulnerability in /_image endpointGHSA-fvmw-cj7j-j39q · 19 Nov 2025< 5.15.95.15.9
ModerateAstro's middleware authentication checks based on url.pathname can be bypassed via url encoded valuesGHSA-ggxq-hp9w-j794 · 19 Nov 2025< 5.15.85.15.8
ModerateAstro vulnerable to URL manipulation via headers, leading to middleware and CVE-2025-61925 bypassGHSA-hr2q-hp5q-x767 · 13 Nov 2025>= 2.16.0, < 5.15.55.15.5
ModerateAstro's `X-Forwarded-Host` is reflected without validationGHSA-5ff5-9fcw-vg88 · 10 Oct 2025< 5.14.35.14.3
ModerateAstro allows unauthorized third-party images in _image endpointGHSA-xf8x-j4p2-f749 · 19 Aug 2025>= 5.0.0-alpha.0, < 5.13.2 · < 4.16.195.13.2
ModerateAstros's duplicate trailing slash feature leads to an open redirection security issueGHSA-cq8c-xv66-36gw · 7 Aug 2025>= 5.2.0, < 5.12.85.12.8
ModerateAtro CSRF Middleware Bypass (security.checkOrigin)GHSA-c4pw-33h3-35xw · 18 Dec 2024< 4.16.174.16.17
ModerateDOM Clobbering Gadget found in astro's client-side router that leads to XSSGHSA-m85w-3h95-hcf9 · 14 Oct 2024>= 3.0.0, < 4.16.14.16.1
LowAstro: Cross-site scripting via unescaped transition:* directive values on hydrated islandsGHSA-7pw4-f3q4-r2p2 · 20 Jul 2026>= 3.10.0, < 7.0.47.0.4
LowAstro: Server island encrypted parameters vulnerable to cross-component replayGHSA-xr5h-phrj-8vxv · 13 May 2026< 6.1.106.1.10
LowAstro: Remote allowlist bypass via unanchored matchPathname wildcardGHSA-g735-7g2w-hh3f · 26 Mar 2026>= 2.10.10, < 5.18.15.18.1
LowAstro Development Server has Arbitrary Local File ReadGHSA-x3h8-62x9-952g · 19 Nov 2025< 5.14.35.14.3
LowAstro development server error page is vulnerable to reflected Cross-site ScriptingGHSA-w2vj-39qv-7vh7 · 13 Nov 2025>= 5.2.0, < 5.15.65.15.6

Quality and security signals

What npm and deps.dev say about the latest release. Signals, not a verdict.

Reading npm and deps.dev…

Registry facts last checked 20 October 2026. Releases and advisories last read 20 October 2026.