CVE-2026-54299 describes an improper input validation vulnerability (CWE-20) in the Astro web framework prior to version 6.4.6. Specifically, SSR applications using prerendered error pages (/404 or /500) fetch these pages over HTTP at runtime when an error occurs. The fetch URL is derived from request.url, which uses the origin from the incoming Host header. Because the Host header is not validated against a whitelist of allowed domains, an attacker can supply a malicious Host header to redirect the fetch to an arbitrary host and read the response content. This can lead to server-side request forgery (SSRF) and information disclosure. The vulnerability is resolved in Astro version 6.4.6.

An attacker can exploit this vulnerability by sending requests with a manipulated Host header, causing the server to fetch error pages from arbitrary hosts. This can lead to information disclosure by reading responses from unintended hosts. The CVSS score of 7.5 (high) reflects the network attack vector, high impact on confidentiality, limited integrity impact, and no availability impact. There are no known exploits in the wild as of the published date.

This vulnerability is fixed in Astro version 6.4.6. Users should upgrade to version 6.4.6 or later to remediate this issue. Since no official patch links or vendor advisory are provided, users should verify the upgrade from the official Astro project sources. Until upgraded, users should ensure that the Host header is validated against a whitelist of allowed domains to prevent exploitation.