CVE-2026-73424: CWE-441: Unintended Proxy or Intermediary ('Confused Deputy') in withastro astro
A vulnerability in the Astro web framework's Vercel adapter allows unauthenticated GET requests to render routes that should be protected by Vercel edge path rules or middleware. This occurs because the adapter accepts the x_astro_path parameter based solely on the x-vercel-isr header, affecting versions from 10.0.3 up to but not including 11.0.3. The issue is fixed in version 11.0.3.
AI Analysis
Technical Summary
CVE-2026-73424 is a CWE-441 (Unintended Proxy or Intermediary) vulnerability in the Astro Vercel adapter. Specifically, from versions 10.0.3 until 11.0.3, the adapter's serverless entrypoint accepts the x_astro_path parameter for the public /_isr function based only on the x-vercel-isr header. This allows unauthenticated GET requests to render routes that are otherwise protected by Vercel edge path rules or split edge middleware, effectively bypassing intended access controls. The vulnerability is resolved in version 11.0.3.
Potential Impact
The vulnerability allows unauthenticated attackers to access and render routes that should be protected by Vercel edge path rules or middleware, potentially exposing sensitive content or functionality. The CVSS score of 6.5 (medium severity) reflects the network attack vector with low complexity and no privileges or user interaction required, resulting in limited confidentiality and integrity impact but no availability impact.
Mitigation Recommendations
This vulnerability is fixed in Astro version 11.0.3. Users should upgrade to version 11.0.3 or later to remediate the issue. Patch status is not explicitly confirmed beyond this fix version; check the vendor advisory for the latest remediation guidance.
CVE-2026-73424: CWE-441: Unintended Proxy or Intermediary ('Confused Deputy') in withastro astro
Description
A vulnerability in the Astro web framework's Vercel adapter allows unauthenticated GET requests to render routes that should be protected by Vercel edge path rules or middleware. This occurs because the adapter accepts the x_astro_path parameter based solely on the x-vercel-isr header, affecting versions from 10.0.3 up to but not including 11.0.3. The issue is fixed in version 11.0.3.
CVSS v3.1
Score 6.5medium
Affected software
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-73424 is a CWE-441 (Unintended Proxy or Intermediary) vulnerability in the Astro Vercel adapter. Specifically, from versions 10.0.3 until 11.0.3, the adapter's serverless entrypoint accepts the x_astro_path parameter for the public /_isr function based only on the x-vercel-isr header. This allows unauthenticated GET requests to render routes that are otherwise protected by Vercel edge path rules or split edge middleware, effectively bypassing intended access controls. The vulnerability is resolved in version 11.0.3.
Potential Impact
The vulnerability allows unauthenticated attackers to access and render routes that should be protected by Vercel edge path rules or middleware, potentially exposing sensitive content or functionality. The CVSS score of 6.5 (medium severity) reflects the network attack vector with low complexity and no privileges or user interaction required, resulting in limited confidentiality and integrity impact but no availability impact.
Mitigation Recommendations
This vulnerability is fixed in Astro version 11.0.3. Users should upgrade to version 11.0.3 or later to remediate the issue. Patch status is not explicitly confirmed beyond this fix version; check the vendor advisory for the latest remediation guidance.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- GitHub_M
- Date Reserved
- 2026-08-12T14:32:11.795Z
- Cvss Version
- 3.1
- State
- PUBLISHED
- Remediation Level
- null
Threat ID: 6a834478bf8831d5394445cf
Added to database: 08/17/2026, 17:27:20 UTC
Last enriched: 08/17/2026, 17:43:27 UTC
Last updated: 08/17/2026, 17:50:20 UTC
Views: 4
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.