HTTP Fetch Vulnerability in Astro Web Framework Affecting Versions Pre-6.4.6

CVE-2026-54299

What is CVE-2026-54299?

The Astro web framework prior to version 6.4.6 is susceptible to an improper header validation vulnerability that could be exploited by an attacker. When Astro SSR applications are configured with prerendered error pages and encounter an error, the framework attempts to fetch the error pages using an HTTP request generated from the Host header of the incoming request. If the Host header is not properly validated against a list of permitted domains, this flaw allows a malicious actor to manipulate the request and potentially redirect it to an arbitrary host. This could lead to unauthorized access to sensitive information returned by the target host.

References