{"id":"CVE-2026-73424","revision":"63817d3f474148008039e7b7c9f3200e","records":[{"revision":"63817d3f474148008039e7b7c9f3200e","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2026-73424","aliases":[],"title":"Astro: Unauthenticated path override in the @astrojs/vercel ISR function","description":"Astro is a web framework for content-driven websites. From 10.0.3 until 11.0.3, the Astro Vercel adapter in packages/integrations/vercel/src/serverless/entrypoint.ts accepts x_astro_path for the public /_isr function based only on the x-vercel-isr header, allowing unauthenticated GET requests to render routes protected only by Vercel edge path rules or split edge middleware. This issue is fixed in 11.0.3.","state":0,"publishedAt":"2026-08-17T17:11:59.782+00:00","modifiedAt":"2026-08-18T14:49:18.484+00:00","affected":[{"ecosystem":"Vendor product","name":"astro","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"withastro\",\n                    \"product\": \"astro\",\n                    \"versions\": [\n                        {\n                            \"version\": \">= 10.0.3, < 11.0.3\",\n                            \"status\": \"affected\"\n                        }\n                    ]\n                }"}],"metrics":[{"system":"CVSS 3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","score":6.5,"severity":"MEDIUM"}],"references":["https://github.com/withastro/astro/security/advisories/GHSA-x27w-589x-frm2","https://github.com/withastro/astro/pull/17370","https://github.com/withastro/astro/commit/3a43cf0f3690a8e33cb30109bc5165611cf38fcd","https://github.com/withastro/astro/releases/tag/@astrojs/vercel@11.0.3"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-73424","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-73424","identifiers":["CVE-2026-73424"]},"retained":false,"historicalAffected":[]}],"coverage":[]}