Missing Authorization Affecting @astrojs/vercel package, versions >=10.0.3 <11.0.3
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk IDSNYK-JS-ASTROJSVERCEL-18599401
- published9 Aug 2026
- disclosed20 Jul 2026
- creditjp-soba
Introduced: 20 Jul 2026
New CVE NOT AVAILABLE CWE-441 (opens in a new tab)Common Weakness Enumeration (CWE) is a category system for software weaknesses
Common Weakness Enumeration (CWE) is a category system for software weaknesses
How to fix?
Upgrade @astrojs/vercel to version 11.0.3 or higher.
Overview
@astrojs/vercel is a Deploy your site to Vercel
Affected versions of this package are vulnerable to Missing Authorization via the _isr process. An attacker can access protected content by sending unauthenticated GET requests with a crafted x_astro_path query parameter, causing the server to render and return any route, even those protected by edge rules or middleware. This is only exploitable if edge-based access controls or middleware are used to protect routes, and the deployment uses split middleware or path-based rules at the edge.