{"id":"EUVD-2026-60306","enisaUuid":"692e9ac1-8861-3064-aaac-d0e8210aba84","description":"Astro is a web framework for content-driven websites. From 10.0.3 until 11.0.3, the Astro Vercel adapter in packages/integrations/vercel/src/serverless/entrypoint.ts accepts x_astro_path for the public /_isr function based only on the x-vercel-isr header, allowing unauthenticated GET requests to render routes protected only by Vercel edge path rules or split edge middleware. This issue is fixed in 11.0.3.","datePublished":"Aug 17, 2026, 5:11:59 PM","dateUpdated":"Aug 18, 2026, 2:49:18 PM","baseScore":6.5,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","references":"https://github.com/withastro/astro/security/advisories/GHSA-x27w-589x-frm2\nhttps://github.com/withastro/astro/pull/17370\nhttps://github.com/withastro/astro/commit/3a43cf0f3690a8e33cb30109bc5165611cf38fcd\nhttps://github.com/withastro/astro/releases/tag/@astrojs/vercel@11.0.3\n","aliases":"CVE-2026-73424\n","assigner":"GitHub_M","epss":0.38,"enisaIdProduct":[{"id":"e61d37fc-2694-32fc-ae5b-32225dda4b7c","product":{"name":"astro","vendor":{"name":"withastro"}},"product_version":"10.0.3, \u003c 11.0.3"}],"enisaIdVendor":[{"id":"1125aade-de24-344d-8203-701bbd6bdb7b","vendor":{"name":"withastro"}}],"enisaIdVulnerability":[{"id":"f7fdc2bb-133d-3829-bbbd-e90c54d44207","vulnerability":{"id":"CVE-2026-73424","description":"Astro is a web framework for content-driven websites. From 10.0.3 until 11.0.3, the Astro Vercel adapter in packages/integrations/vercel/src/serverless/entrypoint.ts accepts x_astro_path for the public /_isr function based only on the x-vercel-isr header, allowing unauthenticated GET requests to render routes protected only by Vercel edge path rules or split edge middleware. This issue is fixed in 11.0.3.","datePublished":"Aug 17, 2026, 5:11:59 PM","dateUpdated":"Aug 18, 2026, 2:49:18 PM","status":"PUBLISHED","baseScore":6.5,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","references":"https://github.com/withastro/astro/security/advisories/GHSA-x27w-589x-frm2\nhttps://github.com/withastro/astro/pull/17370\nhttps://github.com/withastro/astro/commit/3a43cf0f3690a8e33cb30109bc5165611cf38fcd\nhttps://github.com/withastro/astro/releases/tag/@astrojs/vercel@11.0.3\n","enisa_id":"EUVD-2026-60306\n","assigner":"GitHub_M","epss":0.38,"dataProcessed":"Nov 7, 2026, 7:18:26 AM","vulnerabilityProduct":[{"id":"82bc6475-75d8-348b-9ff7-5e19935f33fc","product":{"name":"astro","vendor":{"name":"withastro"}},"product_version":"10.0.3, \u003c 11.0.3"}],"vulnerabilityVendor":[{"id":"9a87d837-bdc4-3d27-8769-974b4e796655","vendor":{"name":"withastro"}}]}}],"enisaIdAdvisory":[]}