Vulnerability-Lookup

CVE-2026-73424 (GCVE-0-2026-73424)

Vulnerability from cvelistv5 – Published: 2026-08-17 17:11 – Updated: 2026-08-18 14:49

Title

Astro: Unauthenticated path override in the @astrojs/vercel ISR function

Summary

Astro is a web framework for content-driven websites. From 10.0.3 until 11.0.3, the Astro Vercel adapter in packages/integrations/vercel/src/serverless/entrypoint.ts accepts x_astro_path for the public /_isr function based only on the x-vercel-isr header, allowing unauthenticated GET requests to render routes protected only by Vercel edge path rules or split edge middleware. This issue is fixed in 11.0.3.

Severity

6.5 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

SSVC

Exploitation: poc Automatable: yes Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-08-18 14:48 UTC

CWE

CWE-441 - Unintended Proxy or Intermediary ('Confused Deputy')
CWE-862 - Missing Authorization

Assigner

GitHub_M mitre root

References

4 references

URL	Tags
https://github.com/withastro/astro/security/advis…	x_refsource_CONFIRM
https://github.com/withastro/astro/pull/17370	x_refsource_MISC
https://github.com/withastro/astro/commit/3a43cf0…	x_refsource_MISC
https://github.com/withastro/astro/releases/tag/@…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version	CPE status
withastro	astro	Affected: >= 10.0.3, < 11.0.3	guessed

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-73424",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-08-18T14:48:58.804991Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-08-18T14:49:18.484Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/withastro/astro/security/advisories/GHSA-x27w-589x-frm2"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "astro",
          "vendor": "withastro",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 10.0.3, \u003c 11.0.3"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Astro is a web framework for content-driven websites. From 10.0.3 until 11.0.3, the Astro Vercel adapter in packages/integrations/vercel/src/serverless/entrypoint.ts accepts x_astro_path for the public /_isr function based only on the x-vercel-isr header, allowing unauthenticated GET requests to render routes protected only by Vercel edge path rules or split edge middleware. This issue is fixed in 11.0.3."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-441",
              "description": "CWE-441: Unintended Proxy or Intermediary (\u0027Confused Deputy\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-862",
              "description": "CWE-862: Missing Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-17T17:11:59.782Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/withastro/astro/security/advisories/GHSA-x27w-589x-frm2",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/withastro/astro/security/advisories/GHSA-x27w-589x-frm2"
        },
        {
          "name": "https://github.com/withastro/astro/pull/17370",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/withastro/astro/pull/17370"
        },
        {
          "name": "https://github.com/withastro/astro/commit/3a43cf0f3690a8e33cb30109bc5165611cf38fcd",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/withastro/astro/commit/3a43cf0f3690a8e33cb30109bc5165611cf38fcd"
        },
        {
          "name": "https://github.com/withastro/astro/releases/tag/@astrojs/vercel@11.0.3",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/withastro/astro/releases/tag/@astrojs/vercel@11.0.3"
        }
      ],
      "source": {
        "advisory": "GHSA-x27w-589x-frm2",
        "discovery": "UNKNOWN"
      },
      "title": "Astro: Unauthenticated path override in the @astrojs/vercel ISR function"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-73424",
    "datePublished": "2026-08-17T17:11:59.782Z",
    "dateReserved": "2026-08-12T14:32:11.795Z",
    "dateUpdated": "2026-08-18T14:49:18.484Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-73424",
      "date": "2026-09-16",
      "epss": "0.00275",
      "percentile": "0.19957"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-73424\",\"sourceIdentifier\":\"security-advisories@github.com\",\"published\":\"2026-08-17T18:18:13.873\",\"lastModified\":\"2026-09-09T21:11:46.833\",\"vulnStatus\":\"Deferred\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"Astro is a web framework for content-driven websites. From 10.0.3 until 11.0.3, the Astro Vercel adapter in packages/integrations/vercel/src/serverless/entrypoint.ts accepts x_astro_path for the public /_isr function based only on the x-vercel-isr header, allowing unauthenticated GET requests to render routes protected only by Vercel edge path rules or split edge middleware. This issue is fixed in 11.0.3.\"}],\"affected\":[{\"source\":\"security-advisories@github.com\",\"affectedData\":[{\"vendor\":\"withastro\",\"product\":\"astro\",\"versions\":[{\"version\":\"\u003e= 10.0.3, \u003c 11.0.3\",\"status\":\"affected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"security-advisories@github.com\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N\",\"baseScore\":6.5,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"LOW\",\"integrityImpact\":\"LOW\",\"availabilityImpact\":\"NONE\"},\"exploitabilityScore\":3.9,\"impactScore\":2.5}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2026-08-18T14:48:58.804991Z\",\"id\":\"CVE-2026-73424\",\"options\":[{\"exploitation\":\"poc\"},{\"automatable\":\"yes\"},{\"technicalImpact\":\"partial\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"security-advisories@github.com\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-441\"},{\"lang\":\"en\",\"value\":\"CWE-862\"}]}],\"references\":[{\"url\":\"https://github.com/withastro/astro/commit/3a43cf0f3690a8e33cb30109bc5165611cf38fcd\",\"source\":\"security-advisories@github.com\"},{\"url\":\"https://github.com/withastro/astro/pull/17370\",\"source\":\"security-advisories@github.com\"},{\"url\":\"https://github.com/withastro/astro/releases/tag/@astrojs/vercel@11.0.3\",\"source\":\"security-advisories@github.com\"},{\"url\":\"https://github.com/withastro/astro/security/advisories/GHSA-x27w-589x-frm2\",\"source\":\"security-advisories@github.com\"},{\"url\":\"https://github.com/withastro/astro/security/advisories/GHSA-x27w-589x-frm2\",\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\"}]}}",
    "vulnrichment": {
      "containers": "{\"cna\": {\"title\": \"Astro: Unauthenticated path override in the @astrojs/vercel ISR function\", \"source\": {\"advisory\": \"GHSA-x27w-589x-frm2\", \"discovery\": \"UNKNOWN\"}, \"metrics\": [{\"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 6.5, \"attackVector\": \"NETWORK\", \"baseSeverity\": \"MEDIUM\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N\", \"integrityImpact\": \"LOW\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"NONE\", \"privilegesRequired\": \"NONE\", \"confidentialityImpact\": \"LOW\"}}], \"affected\": [{\"vendor\": \"withastro\", \"product\": \"astro\", \"versions\": [{\"status\": \"affected\", \"version\": \"\u003e= 10.0.3, \u003c 11.0.3\"}]}], \"references\": [{\"url\": \"https://github.com/withastro/astro/security/advisories/GHSA-x27w-589x-frm2\", \"name\": \"https://github.com/withastro/astro/security/advisories/GHSA-x27w-589x-frm2\", \"tags\": [\"x_refsource_CONFIRM\"]}, {\"url\": \"https://github.com/withastro/astro/pull/17370\", \"name\": \"https://github.com/withastro/astro/pull/17370\", \"tags\": [\"x_refsource_MISC\"]}, {\"url\": \"https://github.com/withastro/astro/commit/3a43cf0f3690a8e33cb30109bc5165611cf38fcd\", \"name\": \"https://github.com/withastro/astro/commit/3a43cf0f3690a8e33cb30109bc5165611cf38fcd\", \"tags\": [\"x_refsource_MISC\"]}, {\"url\": \"https://github.com/withastro/astro/releases/tag/@astrojs/vercel@11.0.3\", \"name\": \"https://github.com/withastro/astro/releases/tag/@astrojs/vercel@11.0.3\", \"tags\": [\"x_refsource_MISC\"]}], \"descriptions\": [{\"lang\": \"en\", \"value\": \"Astro is a web framework for content-driven websites. From 10.0.3 until 11.0.3, the Astro Vercel adapter in packages/integrations/vercel/src/serverless/entrypoint.ts accepts x_astro_path for the public /_isr function based only on the x-vercel-isr header, allowing unauthenticated GET requests to render routes protected only by Vercel edge path rules or split edge middleware. This issue is fixed in 11.0.3.\"}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-441\", \"description\": \"CWE-441: Unintended Proxy or Intermediary (\u0027Confused Deputy\u0027)\"}]}, {\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-862\", \"description\": \"CWE-862: Missing Authorization\"}]}], \"providerMetadata\": {\"orgId\": \"a0819718-46f1-4df5-94e2-005712e83aaa\", \"shortName\": \"GitHub_M\", \"dateUpdated\": \"2026-08-17T17:11:59.782Z\"}}, \"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2026-73424\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"poc\"}, {\"Automatable\": \"yes\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2026-08-18T14:48:58.804991Z\"}}}], \"references\": [{\"url\": \"https://github.com/withastro/astro/security/advisories/GHSA-x27w-589x-frm2\", \"tags\": [\"exploit\"]}], \"providerMetadata\": {\"shortName\": \"CISA-ADP\", \"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"dateUpdated\": \"2026-08-18T14:49:14.529Z\"}}]}",
      "cveMetadata": "{\"cveId\": \"CVE-2026-73424\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-08-17T17:11:59.782Z\", \"dateReserved\": \"2026-08-12T14:32:11.795Z\", \"assignerOrgId\": \"a0819718-46f1-4df5-94e2-005712e83aaa\", \"datePublished\": \"2026-08-17T17:11:59.782Z\", \"assignerShortName\": \"GitHub_M\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}

FKIE_CVE-2026-73424

Vulnerability from fkie_nvd - Published: 2026-08-17 18:18 - Updated: 2026-09-09 21:11

Severity

6.5 (Medium) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Summary

References

	URL	Tags
	security-advisories@github.com	https://github.com/withastro/astro/commit/3a43cf0f3690a8e33cb30109bc5165611cf38fcd
	security-advisories@github.com	https://github.com/withastro/astro/pull/17370
	security-advisories@github.com	https://github.com/withastro/astro/releases/tag/@astrojs/vercel@11.0.3
	security-advisories@github.com	https://github.com/withastro/astro/security/advisories/GHSA-x27w-589x-frm2
	134c704f-9b21-4f2e-91b3-4a467353bcc0	https://github.com/withastro/astro/security/advisories/GHSA-x27w-589x-frm2

Impacted products

	Vendor	Product	Version

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "product": "astro",
          "vendor": "withastro",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 10.0.3, \u003c 11.0.3"
            }
          ]
        }
      ],
      "source": "security-advisories@github.com"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Astro is a web framework for content-driven websites. From 10.0.3 until 11.0.3, the Astro Vercel adapter in packages/integrations/vercel/src/serverless/entrypoint.ts accepts x_astro_path for the public /_isr function based only on the x-vercel-isr header, allowing unauthenticated GET requests to render routes protected only by Vercel edge path rules or split edge middleware. This issue is fixed in 11.0.3."
    }
  ],
  "id": "CVE-2026-73424",
  "lastModified": "2026-09-09T21:11:46.833",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 6.5,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "LOW",
          "integrityImpact": "LOW",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 2.5,
        "source": "security-advisories@github.com",
        "type": "Secondary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-73424",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2026-08-18T14:48:58.804991Z",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2026-08-17T18:18:13.873",
  "references": [
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/withastro/astro/commit/3a43cf0f3690a8e33cb30109bc5165611cf38fcd"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/withastro/astro/pull/17370"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/withastro/astro/releases/tag/@astrojs/vercel@11.0.3"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/withastro/astro/security/advisories/GHSA-x27w-589x-frm2"
    },
    {
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "url": "https://github.com/withastro/astro/security/advisories/GHSA-x27w-589x-frm2"
    }
  ],
  "sourceIdentifier": "security-advisories@github.com",
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-441"
        },
        {
          "lang": "en",
          "value": "CWE-862"
        }
      ],
      "source": "security-advisories@github.com",
      "type": "Secondary"
    }
  ]
}

GHSA-X27W-589X-FRM2

Vulnerability from github – Published: 2026-07-20 23:25 – Updated: 2026-08-17 17:12

Summary

Astro: Unauthenticated path override in the @astrojs/vercel ISR function

Details

Summary

When ISR is enabled, the serverless entrypoint lets an unauthenticated request decide which route the origin renders. The internal _isr function reads the x_astro_path query parameter and rewrites the request path to it without any authentication. Edge level access controls only ever see the /_isr path, so they do not apply to the route that actually gets rendered. This is the same confused deputy problem as CVE-2026-33768, reachable again through the ISR path.

Impact

This affects apps that use @astrojs/vercel with isr: true and protect routes at the edge. Two common setups are affected:

Path rules or firewall deny rules configured on Vercel (for example blocking /admin).
Split deployments (edgeMiddleware: true) where authorization lives in Astro middleware, since that middleware runs at the edge and not in the origin.

An attacker reads any GET rendered route by requesting /_isr?x_astro_path=/the/protected/path. No credentials are required. The protected content is produced by a fresh origin render, so the attack does not depend on the response being cached first.

Details

packages/integrations/vercel/src/serverless/entrypoint.ts picks the real path like this:

if (hasValidMiddlewareSecret) {
  realPath = request.headers.get(ASTRO_PATH_HEADER);       // secret checked
} else if (request.headers.get('x-vercel-isr') === '1') {
  realPath = url.searchParams.get(ASTRO_PATH_PARAM);        // no secret checked
}

The header path is gated by the per build secret and is fine. The ISR branch is not. Two facts make it reachable by anyone:

The _isr function is publicly addressable.
Vercel sets x-vercel-isr: 1 on requests to it, including direct external requests, so the attacker does not even need to send that header.

So GET /_isr?x_astro_path=/admin sets the internal path to /admin and renders it. The edge saw only /_isr, which is allowed, so any path based rule on /admin never fires. In split deployments the edge middleware also runs against /_isr, and the origin does not run middleware at all, so middleware based auth is skipped as well.

How this regressed

CVE-2026-33768 was fixed in 10.0.2 by commit 335a204161 (PR #15959), which required the secret for every path override and removed the query parameter source. Commit aa266364fe (PR #16079, "Fix ISR path rewrite to prevent 404") brought the query parameter back, guarded only by the x-vercel-isr header. That header is not a security boundary, so the fix was effectively undone for ISR routes starting in 10.0.3.

Worth noting the contrast: the original report treated Edge Middleware as the mitigation and scoped the issue to deployments without it. Here, for split deployments, Edge Middleware is bypassed too, since the attacker reaches /_isr directly and the middleware only sees /_isr while the origin runs none.

Proof of concept

Create an Astro app with output: 'server' and adapter vercel({ isr: true }).
Add a page at /admin that returns sensitive content.
Deny /admin at the edge, for example a Vercel path rule that returns 403, or a middleware auth check in a split (edgeMiddleware: true) build.
Request /admin. It is blocked (403).
Request /_isr?x_astro_path=/admin. It returns 200 with the admin content. The response header X-Vercel-Cache: MISS confirms it was rendered fresh, not served from an existing cache entry.

What is not affected

Classic (non split) middleware. It runs inside the origin against the rewritten path, so it still applies to the target route.
State changing requests. Vercel serves ISR functions for GET only, and returns 403 for POST, PUT and DELETE, so the method preserving variant of CVE-2026-33768 does not reproduce here. Impact is limited to reading (confidentiality).
Whole deployment protection (Vercel SSO or password), which also covers /_isr.

Severity

Unauthenticated read of any GET rendered route that is protected only at the edge. No integrity or availability impact because the vector is GET only.

Suggested fix

One option would be to require the secret again for path overrides, the way PR #15959 did, so the ISR branch stops trusting the client supplied x_astro_path. The 404 that PR #16079 was fixing would then need another approach that does not rely on client input.

Severity

6.5 (Medium)


                  
                    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "npm",
        "name": "@astrojs/vercel"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "10.0.3"
            },
            {
              "fixed": "11.0.3"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-73424"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-441",
      "CWE-862"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-07-20T23:25:07Z",
    "nvd_published_at": null,
    "severity": "MODERATE"
  },
  "details": "## Summary\nWhen ISR is enabled, the serverless entrypoint lets an unauthenticated request\ndecide which route the origin renders. The internal `_isr` function reads the\n`x_astro_path` query parameter and rewrites the request path to it without any\nauthentication. Edge level access controls only ever see the `/_isr` path, so\nthey do not apply to the route that actually gets rendered. This is the same\nconfused deputy problem as CVE-2026-33768, reachable again through the ISR path.\n\n## Impact\nThis affects apps that use `@astrojs/vercel` with `isr: true` and protect routes\nat the edge. Two common setups are affected:\n\n1. Path rules or firewall deny rules configured on Vercel (for example blocking\n   `/admin`).\n2. Split deployments (`edgeMiddleware: true`) where authorization lives in Astro\n   middleware, since that middleware runs at the edge and not in the origin.\n\nAn attacker reads any GET rendered route by requesting\n`/_isr?x_astro_path=/the/protected/path`. No credentials are required. The\nprotected content is produced by a fresh origin render, so the attack does not\ndepend on the response being cached first.\n\n## Details\n`packages/integrations/vercel/src/serverless/entrypoint.ts` picks the real path\nlike this:\n\n```js\nif (hasValidMiddlewareSecret) {\n  realPath = request.headers.get(ASTRO_PATH_HEADER);       // secret checked\n} else if (request.headers.get(\u0027x-vercel-isr\u0027) === \u00271\u0027) {\n  realPath = url.searchParams.get(ASTRO_PATH_PARAM);        // no secret checked\n}\n```\n\nThe header path is gated by the per build secret and is fine. The ISR branch is\nnot. Two facts make it reachable by anyone:\n\n1. The `_isr` function is publicly addressable.\n2. Vercel sets `x-vercel-isr: 1` on requests to it, including direct external\n   requests, so the attacker does not even need to send that header.\n\nSo `GET /_isr?x_astro_path=/admin` sets the internal path to `/admin` and renders\nit. The edge saw only `/_isr`, which is allowed, so any path based rule on\n`/admin` never fires. In split deployments the edge middleware also runs against\n`/_isr`, and the origin does not run middleware at all, so middleware based auth\nis skipped as well.\n\n## How this regressed\nCVE-2026-33768 was fixed in 10.0.2 by commit 335a204161 (PR #15959), which\nrequired the secret for every path override and removed the query parameter\nsource. Commit aa266364fe (PR #16079, \"Fix ISR path rewrite to prevent 404\")\nbrought the query parameter back, guarded only by the `x-vercel-isr` header. That\nheader is not a security boundary, so the fix was effectively undone for ISR\nroutes starting in 10.0.3.\n\nWorth noting the contrast: the original report treated Edge Middleware as the\nmitigation and scoped the issue to deployments without it. Here, for split\ndeployments, Edge Middleware is bypassed too, since the attacker reaches `/_isr`\ndirectly and the middleware only sees `/_isr` while the origin runs none.\n\n## Proof of concept\n1. Create an Astro app with `output: \u0027server\u0027` and adapter\n   `vercel({ isr: true })`.\n2. Add a page at `/admin` that returns sensitive content.\n3. Deny `/admin` at the edge, for example a Vercel path rule that returns 403, or\n   a middleware auth check in a split (`edgeMiddleware: true`) build.\n4. Request `/admin`. It is blocked (403).\n5. Request `/_isr?x_astro_path=/admin`. It returns 200 with the admin content.\n   The response header `X-Vercel-Cache: MISS` confirms it was rendered fresh, not\n   served from an existing cache entry.\n\n## What is not affected\n1. Classic (non split) middleware. It runs inside the origin against the rewritten\n   path, so it still applies to the target route.\n2. State changing requests. Vercel serves ISR functions for GET only, and returns\n   403 for POST, PUT and DELETE, so the method preserving variant of CVE-2026-33768\n   does not reproduce here. Impact is limited to reading (confidentiality).\n3. Whole deployment protection (Vercel SSO or password), which also covers `/_isr`.\n\n## Severity\nUnauthenticated read of any GET rendered route that is protected only at the edge.\nNo integrity or availability impact because the vector is GET only.\n\n## Suggested fix\nOne option would be to require the secret again for path overrides, the way\nPR #15959 did, so the ISR branch stops trusting the client supplied `x_astro_path`.\nThe 404 that PR #16079 was fixing would then need another approach that does not\nrely on client input.",
  "id": "GHSA-x27w-589x-frm2",
  "modified": "2026-08-17T17:12:10Z",
  "published": "2026-07-20T23:25:07Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/withastro/astro/security/advisories/GHSA-mr6q-rp88-fx84"
    },
    {
      "type": "WEB",
      "url": "https://github.com/withastro/astro/security/advisories/GHSA-x27w-589x-frm2"
    },
    {
      "type": "WEB",
      "url": "https://github.com/withastro/astro/pull/16079"
    },
    {
      "type": "WEB",
      "url": "https://github.com/withastro/astro/pull/17370"
    },
    {
      "type": "WEB",
      "url": "https://github.com/withastro/astro/commit/3a43cf0f3690a8e33cb30109bc5165611cf38fcd"
    },
    {
      "type": "WEB",
      "url": "https://github.com/withastro/astro/commit/aa266364fe9e105317b66e218fe04567307fb57f"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/withastro/astro"
    },
    {
      "type": "WEB",
      "url": "https://github.com/withastro/astro/releases/tag/@astrojs/vercel@11.0.3"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Astro: Unauthenticated path override in the @astrojs/vercel ISR function"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

CVE-2026-73424 (GCVE-0-2026-73424)

FKIE_CVE-2026-73424

GHSA-X27W-589X-FRM2

Summary

Impact

Details

How this regressed

Proof of concept

What is not affected

Severity

Suggested fix

Tags

Sightings

Nomenclature

Related by attack behaviour