CVE-2026-33768: Astro: Unauthenticated Path Override via `x-astro-path` / `x_astro_path`
The @astrojs/vercel serverless entrypoint reads the x-astro-path header and x_astro_path query parameter to rewrite the internal request path, with no authentication whatsoever. On deployments without Edge Middleware, this lets anyone bypass Vercel’s platform-level path restrictions entirely.
The override preserves the original HTTP method and body, so this isn’t limited to GET. POST, PUT, DELETE all land on the rewritten path. A Firewall rule blocking /admin/* does nothing when the request comes in as POST /api/health?x_astro_path=/admin/delete-user.
References
- github.com/advisories/GHSA-f82v-jwr5-mffw
- github.com/advisories/GHSA-mr6q-rp88-fx84
- github.com/withastro/astro
- github.com/withastro/astro/commit/335a204161f5a7293c128db570901d4f8639c6ed
- github.com/withastro/astro/pull/15959
- github.com/withastro/astro/releases/tag/@astrojs/vercel@10.0.2
- github.com/withastro/astro/security/advisories/GHSA-mr6q-rp88-fx84
- nvd.nist.gov/vuln/detail/CVE-2026-33768
Code Behaviors & Features
Detect and mitigate CVE-2026-33768 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →