CVE-2026-73424

6.5 Moyenne

Publiée le 17/08/2026 à 20:18 · Modifiée le 23/10/2026 à 18:10 · Analyse NVD reportée · Source : security-advisories@github.com

Description

Astro is a web framework for content-driven websites. From 10.0.3 until 11.0.3, the Astro Vercel adapter in packages/integrations/vercel/src/serverless/entrypoint.ts accepts x_astro_path for the public /_isr function based only on the x-vercel-isr header, allowing unauthenticated GET requests to render routes protected only by Vercel edge path rules or split edge middleware. This issue is fixed in 11.0.3.

Traduire en français

Produits concernés

withastro astro

Scores CVSS

Version	Score	Source	Vecteur
3.1	6.5 Moyenne	security-advisories@github.com	`CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N`

Faiblesses (CWE)

CWE-441
CWE-862

Références

https://github.com/withastro/astro/commit/3a43cf0f3690a8e33cb30109bc5165611cf38fcd
https://github.com/withastro/astro/pull/17370
https://github.com/withastro/astro/releases/tag/@astrojs/vercel@11.0.3
https://github.com/withastro/astro/security/advisories/GHSA-x27w-589x-frm2
https://github.com/withastro/astro/security/advisories/GHSA-x27w-589x-frm2

Ailleurs

NVD
CVE.org
CIRCL Vulnerability-Lookup
CERT-FR
GitHub Advisories