GHSA-x27w-589x-frm2: Astro: Unauthenticated path override in the @astrojs/vercel ISR function
(updated )
When ISR is enabled, the serverless entrypoint lets an unauthenticated request
decide which route the origin renders. The internal _isr function reads the
x_astro_path query parameter and rewrites the request path to it without any
authentication. Edge level access controls only ever see the /_isr path, so
they do not apply to the route that actually gets rendered. This is the same
confused deputy problem as CVE-2026-33768, reachable again through the ISR path.
References
- github.com/advisories/GHSA-x27w-589x-frm2
- github.com/withastro/astro/commit/3a43cf0f3690a8e33cb30109bc5165611cf38fcd
- github.com/withastro/astro/commit/aa266364fe9e105317b66e218fe04567307fb57f
- github.com/withastro/astro/pull/16079
- github.com/withastro/astro/pull/17370
- github.com/withastro/astro/releases/tag/@astrojs/vercel@11.0.3
- github.com/withastro/astro/security/advisories/GHSA-mr6q-rp88-fx84
- github.com/withastro/astro/security/advisories/GHSA-x27w-589x-frm2
- nvd.nist.gov/vuln/detail/CVE-2026-73424
Code Behaviors & Features
Detect and mitigate GHSA-x27w-589x-frm2 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →