Skip to content
Threat Feed
Subscribe

Vendor

Astro

3 briefs RSS
high threat

Denial of Service in Astro Node Adapter via Malformed Host Header

A vulnerability in the @astrojs/node adapter, identified as CVE-2026-102984, allows remote attackers to trigger a process crash by sending HTTP requests with malformed Host headers.

exploited @astrojs/node denial-of-service webserver vulnerability
1c
critical advisory

Remote Code Execution in Astro via libheif AVIF Optimization

A critical vulnerability in the libheif library used by the Astro framework allows unauthenticated remote code execution when processing maliciously crafted AVIF images.

Astro
1t
high advisory

Astro Authorization Bypass via Iterative Decode Limit and Canonicalization Mismatch

An authorization bypass vulnerability exists in Astro versions >= 6.4.7 and < 6.4.8, caused by a mismatch in URL path canonicalization, allowing an unauthenticated attacker to bypass middleware protections and access protected routes if the application relies on pathname-based authorization and uses rewrite behavior that performs route matching after middleware execution.

Astro authorization-bypass web-vulnerability nodejs
1r 2t 1c