CVE-2026-33768 - Vulnerability Analysis

Overview

Astro < 10.0.2 @astrojs/vercel serverless entrypoint contains an authentication bypass caused by unvalidated x-astro-path header and x_astro_path query parameter allowing path rewriting, letting attackers bypass platform path restrictions, exploit requires no authentication.

Severity & Score

Impact

Attackers can bypass platform path restrictions to access or modify protected endpoints, potentially leading to unauthorized actions.

Mitigation

Update to version 10.0.2 or later.

References

• https://github.com/withastro/astro/releases/tag/%40astrojs%2Fvercel%4010.0.2
• https://github.com/withastro/astro/security/advisories/GHSA-mr6q-rp88-fx84
• https://github.com/withastro/astro/commit/335a204161f5a7293c128db570901d4f8639c6ed
• https://github.com/withastro/astro/pull/15959

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner