When ISR (Incremental Static Regeneration) is enabled in @astrojs/vercel versions >=10.0.3 and <11.0.3, the serverless entrypoint exposes an unauthenticated path override vulnerability. The internal '_isr' function reads the 'x_astro_path' query parameter and rewrites the request path without verifying a secret, allowing attackers to specify arbitrary routes to be rendered by the origin. Edge-level access controls only see the '/_isr' path and thus do not apply to the actual rendered route, enabling unauthorized access to protected content. This is a regression of CVE-2026-33768 caused by a commit that reintroduced the query parameter without proper authentication. The vulnerability affects setups that protect routes at the edge via path rules or middleware in split deployments. Only GET requests are affected, limiting the impact to confidentiality without integrity or availability concerns.

Attackers can read any GET-rendered route protected only by edge-level controls or edge middleware by requesting '/_isr?x_astro_path=/protected/path' without authentication. This bypasses path-based deny rules and middleware authorization checks that run only at the edge, exposing sensitive content. The origin renders the content fresh on each request, so cached responses are not required. There is no impact on state-changing requests or deployments with whole-deployment protection such as Vercel SSO. The vulnerability compromises confidentiality but not integrity or availability.

A patch is available that restores the requirement for a secret to authorize path overrides in the ISR function, preventing unauthenticated use of the 'x_astro_path' parameter. Users should upgrade to a fixed version (>=11.0.3) once released or apply vendor-provided patches. Until then, consider disabling ISR or protecting the '/_isr' path with authentication mechanisms that cover this endpoint. Edge-level protections alone are insufficient. Monitor vendor advisories for official fixes and guidance.