CVE-2026-73424

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2026-73424

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-73424.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2026-73424

Aliases

GHSA-x27w-589x-frm2

Published

2026-08-17T17:11:59Z

Modified

2026-10-28T02:30:43Z

Severity

6.5 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N CVSS Calculator

Summary

Astro: Unauthenticated path override in the @astrojs/vercel ISR function

Details

Astro is a web framework for content-driven websites. From 10.0.3 until 11.0.3, the Astro Vercel adapter in packages/integrations/vercel/src/serverless/entrypoint.ts accepts x_astro_path for the public /_isr function based only on the x-vercel-isr header, allowing unauthenticated GET requests to render routes protected only by Vercel edge path rules or split edge middleware. This issue is fixed in 11.0.3.

Database specific

{
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-441",
        "CWE-862"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/73xxx/CVE-2026-73424.json"
}

References

Affected packages

Git / github.com/withastro/astro

Affected ranges

Type

GIT

Repo

https://github.com/withastro/astro

Events

Introduced

4a6ff2a40f5aaa844afc5ac2710b129e1d6ca7d5

Fixed

e7d79350659b1910ee88e9e78df13721962773e0

Fixed

3a43cf0f3690a8e33cb30109bc5165611cf38fcd

Database specific

Show details

{
    "extracted_events": [
        {
            "range": [
                {
                    "introduced": "10.0.3"
                },
                {
                    "fixed": "11.0.3"
                }
            ],
            "source": "AFFECTED_FIELD",
            "strategy": "StringRangeExpression"
        },
        {
            "range": [
                {
                    "fixed": "3a43cf0f3690a8e33cb30109bc5165611cf38fcd"
                }
            ],
            "source": "REFERENCES_COMMIT"
        }
    ]
}

Affected versions

@astrojs/alpinejs@1.*

@astrojs/alpinejs@1.0.0

@astrojs/check@0.*

@astrojs/check@0.9.9

@astrojs/cloudflare@13.*

@astrojs/cloudflare@13.1.10

@astrojs/cloudflare@13.1.4

@astrojs/cloudflare@13.1.5

@astrojs/cloudflare@13.1.6

@astrojs/cloudflare@13.1.7

@astrojs/cloudflare@13.1.8

@astrojs/cloudflare@13.1.9

@astrojs/cloudflare@13.2.0

@astrojs/cloudflare@13.2.1

@astrojs/cloudflare@13.2.2

@astrojs/cloudflare@13.3.0

@astrojs/cloudflare@13.3.1

@astrojs/cloudflare@13.4.0

@astrojs/cloudflare@13.5.0

@astrojs/cloudflare@13.5.1

@astrojs/cloudflare@13.5.2

@astrojs/cloudflare@13.5.3

@astrojs/cloudflare@13.5.4

@astrojs/cloudflare@13.5.5

@astrojs/cloudflare@13.6.0

@astrojs/cloudflare@13.6.1

@astrojs/cloudflare@13.7.0

@astrojs/cloudflare@14.*

@astrojs/cloudflare@14.0.0

@astrojs/cloudflare@14.0.0-beta.3

@astrojs/cloudflare@14.0.1

@astrojs/cloudflare@14.0.2

@astrojs/cloudflare@14.1.0

@astrojs/cloudflare@14.1.1

@astrojs/cloudflare@14.1.2

@astrojs/cloudflare@14.1.3

@astrojs/db@0.*

@astrojs/db@0.21.0

@astrojs/db@0.21.1

@astrojs/db@0.21.2

@astrojs/db@0.21.3

@astrojs/internal-helpers@0.*

@astrojs/internal-helpers@0.10.0

@astrojs/internal-helpers@0.10.1

@astrojs/internal-helpers@0.9.0

@astrojs/internal-helpers@0.9.1

@astrojs/language-server@2.*

@astrojs/language-server@2.16.10

@astrojs/language-server@2.16.11

@astrojs/language-server@2.16.12

@astrojs/language-server@2.16.7

@astrojs/language-server@2.16.8

@astrojs/language-server@2.16.9

@astrojs/markdoc@1.*

@astrojs/markdoc@1.0.3

@astrojs/markdoc@1.0.4

@astrojs/markdoc@1.0.5

@astrojs/markdoc@1.0.6

@astrojs/markdoc@2.*

@astrojs/markdoc@2.0.0

@astrojs/markdoc@2.0.1

@astrojs/markdoc@2.0.2

@astrojs/markdoc@2.0.3

@astrojs/markdown-remark@7.*

@astrojs/markdown-remark@7.1.0

@astrojs/markdown-remark@7.1.1

@astrojs/markdown-remark@7.1.2

@astrojs/markdown-remark@7.2.0

@astrojs/markdown-remark@7.2.1

@astrojs/markdown-satteri@0.*

@astrojs/markdown-satteri@0.2.0

@astrojs/markdown-satteri@0.2.1

@astrojs/markdown-satteri@0.2.2

@astrojs/markdown-satteri@0.3.0

@astrojs/markdown-satteri@0.3.1

@astrojs/markdown-satteri@0.3.1-beta.2

@astrojs/markdown-satteri@0.3.2

@astrojs/markdown-satteri@0.3.3

@astrojs/markdown-satteri@0.3.4

@astrojs/mdx@5.*

@astrojs/mdx@5.0.3

@astrojs/mdx@5.0.4

@astrojs/mdx@5.0.5

@astrojs/mdx@5.0.6

@astrojs/mdx@6.*

@astrojs/mdx@6.0.0

@astrojs/mdx@6.0.2

@astrojs/mdx@6.0.3

@astrojs/mdx@7.*

@astrojs/mdx@7.0.0

@astrojs/mdx@7.0.0-beta.3

@astrojs/mdx@7.0.0-beta.4

@astrojs/mdx@7.0.1

@astrojs/mdx@7.0.2

@astrojs/mdx@7.0.3

@astrojs/netlify@7.*

@astrojs/netlify@7.0.10

@astrojs/netlify@7.0.11

@astrojs/netlify@7.0.12

@astrojs/netlify@7.0.13

@astrojs/netlify@7.0.5

@astrojs/netlify@7.0.6

@astrojs/netlify@7.0.7

@astrojs/netlify@7.0.8

@astrojs/netlify@7.0.9

@astrojs/netlify@8.*

@astrojs/netlify@8.0.0

@astrojs/netlify@8.1.0

@astrojs/netlify@8.1.1

@astrojs/netlify@8.1.2

@astrojs/node@10.*

@astrojs/node@10.0.4

@astrojs/node@10.0.5

@astrojs/node@10.0.6

@astrojs/node@10.1.0

@astrojs/node@10.1.1

@astrojs/node@10.1.2

@astrojs/node@10.1.3

@astrojs/node@10.1.4

@astrojs/node@11.*

@astrojs/node@11.0.0

@astrojs/node@11.0.0-beta.2

@astrojs/node@11.0.1

@astrojs/node@11.0.2

@astrojs/partytown@2.*

@astrojs/partytown@2.1.6

@astrojs/partytown@2.1.7

@astrojs/preact@5.*

@astrojs/preact@5.1.0

@astrojs/preact@5.1.1

@astrojs/preact@5.1.2

@astrojs/preact@5.1.3

@astrojs/preact@5.1.4

@astrojs/preact@5.1.5

@astrojs/preact@6.*

@astrojs/preact@6.0.0

@astrojs/preact@6.0.0-beta.2

@astrojs/preact@6.0.1

@astrojs/prism@4.*

@astrojs/prism@4.0.2

@astrojs/react@5.*

@astrojs/react@5.0.2

@astrojs/react@5.0.3

@astrojs/react@5.0.4

@astrojs/react@5.0.5

@astrojs/react@5.0.6

@astrojs/react@5.0.7

@astrojs/react@6.*

@astrojs/react@6.0.0

@astrojs/react@6.0.0-beta.2

@astrojs/react@6.0.1

@astrojs/rss@4.*

@astrojs/rss@4.0.18

@astrojs/rss@4.0.19

@astrojs/sitemap@3.*

@astrojs/sitemap@3.7.2

@astrojs/sitemap@3.7.3

@astrojs/solid-js@7.*

@astrojs/solid-js@7.0.0

@astrojs/solid-js@7.0.0-beta.2

@astrojs/solid-js@7.0.1

@astrojs/svelte@8.*

@astrojs/svelte@8.0.4

@astrojs/svelte@8.0.5

@astrojs/svelte@8.1.0

@astrojs/svelte@8.1.1

@astrojs/svelte@8.1.2

@astrojs/svelte@9.*

@astrojs/svelte@9.0.0

@astrojs/svelte@9.0.0-beta.4

@astrojs/svelte@9.0.1

@astrojs/telemetry@3.*

@astrojs/telemetry@3.3.1

@astrojs/telemetry@3.3.2

@astrojs/telemetry@3.3.3

@astrojs/ts-plugin@1.*

@astrojs/ts-plugin@1.10.10

@astrojs/ts-plugin@1.10.8

@astrojs/ts-plugin@1.10.9

@astrojs/underscore-redirects@1.*

@astrojs/underscore-redirects@1.0.3

@astrojs/upgrade@0.*

@astrojs/upgrade@0.7.2

@astrojs/upgrade@0.7.3

@astrojs/vercel@10.*

@astrojs/vercel@10.0.3

@astrojs/vercel@10.0.4

@astrojs/vercel@10.0.5

@astrojs/vercel@10.0.6

@astrojs/vercel@10.0.7

@astrojs/vercel@10.0.8

@astrojs/vercel@11.*

@astrojs/vercel@11.0.0

@astrojs/vercel@11.0.1

@astrojs/vercel@11.0.2

@astrojs/vue@7.*

@astrojs/vue@7.0.0

@astrojs/vue@7.0.0-beta.2

@astrojs/vue@7.0.1

@astrojs/yaml2ts@0.*

@astrojs/yaml2ts@0.2.4

astro-vscode@2.*

astro-vscode@2.16.14

astro-vscode@2.16.15

astro-vscode@2.16.16

astro-vscode@2.16.17

astro@6.*

astro@6.1.0

astro@6.1.1

astro@6.1.10

astro@6.1.2

astro@6.1.3

astro@6.1.4

astro@6.1.5

astro@6.1.6

astro@6.1.7

astro@6.1.8

astro@6.1.9

astro@6.2.0

astro@6.2.1

astro@6.2.2

astro@6.3.0

astro@6.3.1

astro@6.3.2

astro@6.3.3

astro@6.3.4

astro@6.3.5

astro@6.3.6

astro@6.3.7

astro@6.3.8

astro@6.4.0

astro@6.4.2

astro@6.4.3

astro@6.4.4

astro@6.4.5

astro@6.4.6

astro@6.4.7

astro@7.*

astro@7.0.0

astro@7.0.0-beta.4

astro@7.0.0-beta.5

astro@7.0.0-beta.6

astro@7.0.1

astro@7.0.2

astro@7.0.3

astro@7.0.4

astro@7.0.5

astro@7.0.6

astro@7.0.7

astro@7.0.8

create-astro@5.*

create-astro@5.0.4

create-astro@5.0.5

create-astro@5.0.6

create-astro@5.1.0

create-astro@5.1.0-beta.0

create-astro@5.2.0

create-astro@5.2.1

create-astro@5.2.2

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-73424.json"