astro@6.4.3

astro is an Astro is a modern site builder with web best practices, performance, and DX front-of-mind.

Affected versions of this package are vulnerable to Cross-site Scripting (XSS) via the server-side generation of the style element when unescaped animation properties are interpolated from attacker-controlled input. An attacker can execute arbitrary JavaScript in the context of the affected application by injecting specially crafted values that break out of the style element and insert malicious scripts.

Upgrade astro to version 7.1.0 or higher.

astro is an Astro is a modern site builder with web best practices, performance, and DX front-of-mind.

Affected versions of this package are vulnerable to Improper Encoding or Escaping of Output via the transition:persist, transition:scope, or transition:persist-props directives when unescaped values are copied onto the rendered <astro-island> element. An attacker can inject arbitrary HTML or JavaScript into the server-rendered output by supplying crafted input that is reflected into these directives.

Note: This is only exploitable if the application developer passes untrusted, request-derived input directly into a transition directive.

Upgrade astro to version 7.0.4 or higher.

astro is an Astro is a modern site builder with web best practices, performance, and DX front-of-mind.

Affected versions of this package are vulnerable to Use of Non-Canonical URL Paths for Authorization Decisions in validateAndDecodePathname and rewrite routing in findRouteToRewrite. An attacker can reach protected routes by sending an over-encoded URL whose path is only partially decoded for middleware checks but then decoded again during route matching. This lets unauthenticated requests slip past pathname-based middleware authorization and still resolve to routes such as /admin or /api/admin. The result is unauthorized access to protected pages or APIs that the application intended to block.

Notes

• The bypass is only exposed in deployments that are authorized by inspecting context.url.pathname and then handing the request back into Astro’s rewrite flow with next(context.url), so middleware and routing can see different pathname representations for the same request.
• The affected route checks are not limited to page paths; the maintainer’s advisory examples include API and other internal endpoints, so applications using pathname-based protections for non-page handlers are in scope as well.

Upgrade astro to version 6.4.8 or higher.

astro is an Astro is a modern site builder with web best practices, performance, and DX front-of-mind.

Affected versions of this package are vulnerable to Server-side Request Forgery (SSRF) via the prerenderedErrorPageFetch. An attacker can access sensitive information or interact with internal resources by sending a crafted request with a malicious Host header, which causes the server to fetch error pages from an attacker-controlled host and reflect the response back to the client.

Note: This is only exploitable if the deployment uses prerendered error pages and the internal createRequestFromNodeRequest builder with app.render() without overriding the default error page fetch behavior.

Upgrade astro to version 6.4.6 or higher.