Vulnerability in Astro Framework Vercel Adapter Affects Content-driven Websites
CVE-2026-73424

6.5MEDIUM

Key Information:

Vendor

Withastro

Status
Astro
Vendor
CVE Published:
17 August 2026

What is CVE-2026-73424?

The Astro framework's Vercel adapter has a vulnerability that permits unauthenticated GET requests due to improper handling of the x_astro_path parameter for the /_isr function, reliant solely on the x-vercel-isr header. This oversight allows unauthorized access to routes typically secured by Vercel edge path rules or split edge middleware, posing a risk to the integrity of content-driven websites. The issue has been addressed in version 11.0.3, ensuring enhanced security for users.

Affected Version(s)

astro >= 10.0.3, < 11.0.3

References

https://github.com/withastro/astro/security/advisories/GH...
x_refsource_CONFIRM
https://github.com/withastro/astro/pull/17370
x_refsource_MISC
https://github.com/withastro/astro/commit/3a43cf0f3690a8e...
x_refsource_MISC

CVSS V3.1

Score:
6.5
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.