Server-Side Request Forgery Risk in Astro Framework by Astro

CVE-2026-33768

What is CVE-2026-33768?

The Astro framework contained a vulnerability prior to version 10.0.2 that allowed unauthorized access through the @astrojs/vercel serverless entrypoint. By exploiting the x-astro-path header and x_astro_path query parameter, attackers could bypass Vercel’s platform security measures, creating a serious risk. This flaw enabled all HTTP methods, including POST, PUT, and DELETE, to reach unauthorized internal paths. Consequently, even firewall rules designed to guard sensitive endpoints would be ineffective. The issue has been resolved in version 10.0.2, which emphasizes the importance of keeping dependencies updated to mitigate potential exploits.

References