https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Mon, 05 Oct 2026 18:26:04 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-277276 EUVD-2026-277276 https://cve.radiocsirt.org/vuln/euvd-2026-277276 https://cve.radiocsirt.org/vuln/fkie_cve-2026-33768 <p>Astro is a web framework. Prior to version 10.0.2, the @astrojs/vercel serverless entrypoint reads the x-astro-path header and x_astro_path query parameter to rewrite the internal request path, with no authentication whatsoever. On deployments without Edge Middleware, this lets anyone bypass Vercel&#39;s platform-level path restrictions entirely. The override preserves the original HTTP method and body, so this isn&#39;t limited to GET. POST, PUT, DELETE all land on the rewritten path. A Firewall rule blocking /admin/* does nothing when the request comes in as POST /api/health?x_astro_path=/admin/delete-user. This issue has been patched in version 10.0.2.</p> <p>Astro is a web framework. Prior to version 10.0.2, the @astrojs/vercel serverless entrypoint reads the x-astro-path header and x_astro_path query parameter to rewrite the internal request path, with no authentication whatsoever. On deployments without Edge Middleware, this lets anyone bypass Vercel&#39;s platform-level path restrictions entirely. The override preserves the original HTTP method and body, so this isn&#39;t limited to GET. POST, PUT, DELETE all land on the rewritten path. A Firewall rule blocking /admin/* does nothing when the request comes in as POST /api/health?x_astro_path=/admin/delete-user. This issue has been patched in version 10.0.2.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-33768 https://cve.radiocsirt.org/vuln/ghsa-mr6q-rp88-fx84 <p><strong>Affected:</strong> npm: @astrojs/vercel</p> <p>## Summary</p> <p>The `@astrojs/vercel` serverless entrypoint reads the `x-astro-path` header and `x_astro_path` query parameter to rewrite the internal request path, with no authentication whatsoever. On deployments without Edge Middleware, this lets anyone bypass Vercel&#39;s platform-level path restrictions entirely.</p> <p>The override preserves the original HTTP method and body, so this isn&#39;t limited to GET. POST, PUT, DELETE all land on the rewritten path. A Firewall rule blocking `/admin/*` does nothing when the request comes in as `POST /api/health?x_astro_path=/admin/delete-user`.</p> <p>## Affected Versions</p> <p>Verified against: - **Astro 5.18.1 + @astrojs/vercel 9.0.4** — GET and POST override both work. Full exploitation. - **Astro 6.0.3 + @astrojs/vercel 10.0.0** — GET override works. POST/DELETE hit a `duplex` bug in the Request constructor (the `duplex: &#39;half&#39;` option is required when passing a ReadableStream body — this has been an issue since Node.js 18 but is consistently enforced in the Node.js 22+ runtime that Astro 6 requires). This is not a security fix — the code explicitly passes `body: request.body` and intends to preserve it. Once the missing `duplex` option is added, all methods will be exploitable on v6 as well.</p> <p>The vulnerable code path is identical across both versions.</p> <p>## Affected Component</p> <p>- **Package**: `@astrojs/vercel` - **File**: `packages/integrations/vercel/src/serverless/entrypoint.ts` (lines 19–28) - **Constants**: `packages/integrations/vercel/src/index.ts`…</p> <p><strong>Affected:</strong> npm: @astrojs/vercel</p> <p>## Summary</p> <p>The `@astrojs/vercel` serverless entrypoint reads the `x-astro-path` header and `x_astro_path` query parameter to rewrite the internal request path, with no authentication whatsoever. On deployments without Edge Middleware, this lets anyone bypass Vercel&#39;s platform-level path restrictions entirely.</p> <p>The override preserves the original HTTP method and body, so this isn&#39;t limited to GET. POST, PUT, DELETE all land on the rewritten path. A Firewall rule blocking `/admin/*` does nothing when the request comes in as `POST /api/health?x_astro_path=/admin/delete-user`.</p> <p>## Affected Versions</p> <p>Verified against: - **Astro 5.18.1 + @astrojs/vercel 9.0.4** — GET and POST override both work. Full exploitation. - **Astro 6.0.3 + @astrojs/vercel 10.0.0** — GET override works. POST/DELETE hit a `duplex` bug in the Request constructor (the `duplex: &#39;half&#39;` option is required when passing a ReadableStream body — this has been an issue since Node.js 18 but is consistently enforced in the Node.js 22+ runtime that Astro 6 requires). This is not a security fix — the code explicitly passes `body: request.body` and intends to preserve it. Once the missing `duplex` option is added, all methods will be exploitable on v6 as well.</p> <p>The vulnerable code path is identical across both versions.</p> <p>## Affected Component</p> <p>- **Package**: `@astrojs/vercel` - **File**: `packages/integrations/vercel/src/serverless/entrypoint.ts` (lines 19–28) - **Constants**: `packages/integrations/vercel/src/index.ts`…</p> https://cve.radiocsirt.org/vuln/ghsa-mr6q-rp88-fx84