CVE-2026-73424
Received Received - Intake

Astro Vercel Adapter Path Bypass via Unauthenticated Requests

Publication date: 2026-08-17

Last updated on: 2026-08-17

Assigner: GitHub, Inc.

Description
Astro is a web framework for content-driven websites. From 10.0.3 until 11.0.3, the Astro Vercel adapter in packages/integrations/vercel/src/serverless/entrypoint.ts accepts x_astro_path for the public /_isr function based only on the x-vercel-isr header, allowing unauthenticated GET requests to render routes protected only by Vercel edge path rules or split edge middleware. This issue is fixed in 11.0.3.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-17
Last Modified
2026-08-17
Generated
2026-08-17
AI Q&A
2026-08-17
EPSS Evaluated
N/A
NVD
CVE-2026-73424
EUVD
EUVD-2026-60306

Affected Vendors & Products

Showing 5 associated CPEs
Vendor Product Version / Range
withastro astro From 10.0.3 (inc)
withastro astro to 11.0.3 (inc)
withastro astro 11.0.3
astro astro From 10.0.3 (inc) to 11.0.3 (inc)
astro astro 11.0.3

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-862 The product does not perform an authorization check when an actor attempts to access a resource or perform an action.
CWE-441 The product receives a request, message, or directive from an upstream component, but the product does not sufficiently preserve the original source of the request before forwarding the request to an external actor that is outside of the product's control sphere. This causes the product to appear to be the source of the request, leading it to act as a proxy or other intermediary between the upstream component and the external actor.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability affects the Astro framework's Vercel adapter in versions 10.0.3 to 11.0.2. It allows unauthenticated attackers to bypass access controls by manipulating the x_astro_path query parameter in requests to the /_isr endpoint. The issue occurs because the adapter previously relied only on the x-vercel-isr header for path validation, enabling unauthorized access to protected routes.

Detection Guidance

To detect this vulnerability, monitor requests to the /_isr endpoint in Astro Vercel deployments. Check for unauthenticated GET requests containing the x_astro_path parameter without proper validation. Review server logs for suspicious path overrides or 404 errors in ISR routes.

Impact Analysis

An attacker could exploit this to read sensitive routes that should be protected by edge-level access controls. Since the attack only allows GET requests, integrity and availability of data are not affected. However, unauthorized access to protected content may lead to data leaks or privacy violations.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, potentially violating GDPR's data protection principles or HIPAA's access controls. Organizations using affected Astro versions may face compliance risks due to potential data exposure.

Mitigation Strategies

Upgrade to Astro version 11.0.3 or later. Ensure the @astrojs/vercel integration is updated. Verify that ISR routes no longer accept x_astro_path without proper token validation. Test ISR functionality to confirm path overrides are blocked.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-73424. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart