@Astrojs/Vercel
Approved changes feed: RSS · Atom
cpe:2.3:a:astro:\@astrojs\/vercel:*:*:*:*:*:*:*:*
part: a version: * update: *
| Vendor | Astro (da7333ee-9eb6-5594-ad19-bfc76837073a) |
|---|---|
| Product | @Astrojs/Vercel (1abf14ce-008e-5197-86e5-150228bebc6c) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
| Notes | Imported from gcve-enriched-dumps CVE data |
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
| No PURL mappings for this CPE yet. | ||
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2026-33768 |
vulnerable | 2026-06-08 07:59:10.729304 |
Astro: Unauthenticated Path Override via `x-astro-path` / `x_astro_path`
MEDIUM (6.5)
Astro is a web framework. Prior to version 10.0.2, the @astrojs/vercel serverless entrypoint reads the x-astro-path header and x_astro_path query parameter to rewrite the internal request path, with no authentication whatsoever. On deployments without Edge Middleware, this lets anyone bypass Vercel's platform-level path restrictions entirely. The override preserves the original HTTP method and body, so this isn't limited to GET. POST, PUT, DELETE all land on the rewritten path. A Firewall rule blocking /admin/* does nothing when the request comes in as POST /api/health?x_astro_path=/admin/delete-user. This issue has been patched in version 10.0.2.
Published: 2026-03-24T18:40:12.549Z
Updated: 2026-03-24T18:53:24.069Z |
Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.