{"id":"CVE-2026-73424","summary":"Astro: Unauthenticated path override in the @astrojs/vercel ISR function","details":"Astro is a web framework for content-driven websites. From 10.0.3 until 11.0.3, the Astro Vercel adapter in packages/integrations/vercel/src/serverless/entrypoint.ts accepts x_astro_path for the public /_isr function based only on the x-vercel-isr header, allowing unauthenticated GET requests to render routes protected only by Vercel edge path rules or split edge middleware. This issue is fixed in 11.0.3.","aliases":["GHSA-x27w-589x-frm2"],"modified":"2026-08-20T03:30:11.610623070Z","published":"2026-08-17T17:11:59.782Z","database_specific":{"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/73xxx/CVE-2026-73424.json","cna_assigner":"GitHub_M","cwe_ids":["CWE-441","CWE-862"]},"references":[{"type":"WEB","url":"https://github.com/withastro/astro/releases/tag/@astrojs/vercel@11.0.3"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/73xxx/CVE-2026-73424.json"},{"type":"ADVISORY","url":"https://github.com/withastro/astro/security/advisories/GHSA-x27w-589x-frm2"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-73424"},{"type":"FIX","url":"https://github.com/withastro/astro/commit/3a43cf0f3690a8e33cb30109bc5165611cf38fcd"},{"type":"FIX","url":"https://github.com/withastro/astro/pull/17370"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/withastro/astro","events":[{"introduced":"4a6ff2a40f5aaa844afc5ac2710b129e1d6ca7d5"},{"fixed":"3a43cf0f3690a8e33cb30109bc5165611cf38fcd"}],"database_specific":{"extracted_events":[{"introduced":"10.0.3"},{"fixed":"11.0.3"}],"source":["AFFECTED_FIELD","REFERENCES"]}}],"versions":["astro@7.0.8","@astrojs/netlify@8.1.2","@astrojs/mdx@7.0.3","@astrojs/markdown-satteri@0.3.4","@astrojs/language-server@2.16.12","@astrojs/cloudflare@14.1.3","astro@7.0.7","@astrojs/telemetry@3.3.3","@astrojs/cloudflare@14.1.2","create-astro@5.2.2","astro@7.0.6","@astrojs/vercel@11.0.2","@astrojs/ts-plugin@1.10.10","@astrojs/solid-js@7.0.1","@astrojs/react@6.0.1","@astrojs/preact@6.0.1","@astrojs/node@11.0.2","@astrojs/netlify@8.1.1","@astrojs/mdx@7.0.2","@astrojs/markdown-satteri@0.3.3","@astrojs/markdown-remark@7.2.1","@astrojs/markdoc@2.0.3","@astrojs/language-server@2.16.11","@astrojs/internal-helpers@0.10.1","@astrojs/cloudflare@14.1.1","astro@7.0.5","astro-vscode@2.16.17","@astrojs/vue@7.0.1","@astrojs/vercel@11.0.1","@astrojs/svelte@9.0.1","@astrojs/node@11.0.1","@astrojs/netlify@8.1.0","@astrojs/mdx@7.0.1","@astrojs/markdoc@2.0.2","@astrojs/cloudflare@14.1.0","create-astro@5.2.1","astro@7.0.4","@astrojs/rss@4.0.19","@astrojs/cloudflare@14.0.2","create-astro@5.2.0","astro@7.0.3","@astrojs/upgrade@0.7.3","@astrojs/markdoc@2.0.1","@astrojs/cloudflare@14.0.1","astro@7.0.2","@astrojs/markdown-satteri@0.3.2","astro@7.0.1","create-astro@5.1.0","astro@7.0.0","@astrojs/vue@7.0.0","@astrojs/vercel@11.0.0","@astrojs/svelte@9.0.0","@astrojs/solid-js@7.0.0","@astrojs/react@6.0.0","@astrojs/preact@6.0.0","@astrojs/node@11.0.0","@astrojs/netlify@8.0.0","@astrojs/mdx@7.0.0","@astrojs/markdown-satteri@0.3.1","@astrojs/markdoc@2.0.0","@astrojs/cloudflare@14.0.0","@astrojs/alpinejs@1.0.0","create-astro@5.1.0-beta.0","astro@7.0.0-beta.6","@astrojs/mdx@7.0.0-beta.4","@astrojs/markdown-satteri@0.3.1-beta.2","@astrojs/cloudflare@14.0.0-beta.3","astro@7.0.0-beta.5","@astrojs/vue@7.0.0-beta.2","@astrojs/svelte@9.0.0-beta.4","@astrojs/solid-js@7.0.0-beta.2","@astrojs/react@6.0.0-beta.2","@astrojs/preact@6.0.0-beta.2","@astrojs/mdx@7.0.0-beta.3","astro@6.4.7","astro@7.0.0-beta.4","@astrojs/node@11.0.0-beta.2","astro@6.4.6","@astrojs/netlify@7.0.13","astro@6.4.5","@astrojs/node@10.1.4","@astrojs/mdx@6.0.3","@astrojs/markdown-satteri@0.3.0","@astrojs/db@0.21.3","@astrojs/cloudflare@13.7.0","astro@6.4.4","@astrojs/mdx@6.0.2","@astrojs/markdown-satteri@0.2.2","astro@6.4.3","@astrojs/react@5.0.7","@astrojs/preact@5.1.5","@astrojs/node@10.1.3","@astrojs/netlify@7.0.12","@astrojs/cloudflare@13.6.1","astro@6.4.2","@astrojs/markdown-satteri@0.2.1","astro@6.4.0","@astrojs/vercel@10.0.8","@astrojs/react@5.0.6","@astrojs/preact@5.1.4","@astrojs/node@10.1.2","@astrojs/netlify@7.0.11","@astrojs/mdx@6.0.0","@astrojs/markdown-satteri@0.2.0","@astrojs/markdown-remark@7.2.0","@astrojs/markdoc@1.0.6","@astrojs/internal-helpers@0.10.0","@astrojs/cloudflare@13.6.0","astro@6.3.8","@astrojs/svelte@8.1.2","@astrojs/sitemap@3.7.3","@astrojs/language-server@2.16.10","@astrojs/cloudflare@13.5.5","astro@6.3.7","@astrojs/cloudflare@13.5.4","astro@6.3.6","@astrojs/cloudflare@13.5.3","astro@6.3.5","astro@6.3.4","astro-vscode@2.16.16","@astrojs/yaml2ts@0.2.4","@astrojs/ts-plugin@1.10.9","@astrojs/netlify@7.0.10","@astrojs/language-server@2.16.9","@astrojs/db@0.21.2","@astrojs/cloudflare@13.5.2","astro@6.3.3","@astrojs/mdx@5.0.6","astro@6.3.2","astro-vscode@2.16.15","@astrojs/vercel@10.0.7","@astrojs/ts-plugin@1.10.8","@astrojs/svelte@8.1.1","@astrojs/react@5.0.5","@astrojs/prism@4.0.2","@astrojs/preact@5.1.3","@astrojs/node@10.1.1","@astrojs/netlify@7.0.9","@astrojs/mdx@5.0.5","@astrojs/markdown-remark@7.1.2","@astrojs/markdoc@1.0.5","@astrojs/internal-helpers@0.9.1","@astrojs/cloudflare@13.5.1","@astrojs/node@10.1.0","@astrojs/cloudflare@13.5.0","astro@6.3.1","astro@6.3.0","@astrojs/telemetry@3.3.2","@astrojs/language-server@2.16.8","@astrojs/cloudflare@13.4.0","astro@6.2.2","@astrojs/cloudflare@13.3.1","astro@6.2.1","@astrojs/db@0.21.1","astro@6.2.0","@astrojs/cloudflare@13.3.0","astro@6.1.10","@astrojs/vercel@10.0.6","@astrojs/svelte@8.1.0","@astrojs/language-server@2.16.7","@astrojs/db@0.21.0","@astrojs/cloudflare@13.2.2","@astrojs/check@0.9.9","@astrojs/cloudflare@13.2.1","create-astro@5.0.6","astro@6.1.9","@astrojs/vercel@10.0.5","@astrojs/upgrade@0.7.2","@astrojs/react@5.0.4","@astrojs/preact@5.1.2","@astrojs/node@10.0.6","@astrojs/netlify@7.0.8","@astrojs/mdx@5.0.4","@astrojs/markdown-remark@7.1.1","@astrojs/markdoc@1.0.4","@astrojs/internal-helpers@0.9.0","@astrojs/cloudflare@13.2.0","astro@6.1.8","@astrojs/telemetry@3.3.1","astro@6.1.7","@astrojs/node@10.0.5","@astrojs/netlify@7.0.7","@astrojs/cloudflare@13.1.10","astro@6.1.6","@astrojs/svelte@8.0.5","@astrojs/partytown@2.1.7","@astrojs/cloudflare@13.1.9","astro@6.1.5","@astrojs/cloudflare@13.1.8","astro@6.1.4","@astrojs/react@5.0.3","astro@6.1.3","@astrojs/vercel@10.0.4","@astrojs/underscore-redirects@1.0.3","@astrojs/preact@5.1.1","@astrojs/netlify@7.0.6","@astrojs/cloudflare@13.1.7","@astrojs/cloudflare@13.1.6","create-astro@5.0.5","astro@6.1.2","@astrojs/cloudflare@13.1.5","create-astro@5.0.4","astro@6.1.1","astro@6.1.0","astro-vscode@2.16.14","@astrojs/vercel@10.0.3","@astrojs/svelte@8.0.4","@astrojs/sitemap@3.7.2","@astrojs/rss@4.0.18","@astrojs/react@5.0.2","@astrojs/preact@5.1.0","@astrojs/partytown@2.1.6","@astrojs/node@10.0.4","@astrojs/netlify@7.0.5","@astrojs/mdx@5.0.3","@astrojs/markdown-remark@7.1.0","@astrojs/markdoc@1.0.3","@astrojs/cloudflare@13.1.4"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-73424.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N"}]}