Astro

Astro: Host header SSRF in prerendered error page fetch

Astro's server source code is exposed to the public if sourcemaps are enabled

Astro's `X-Forwarded-Host` is reflected without validation

Astro: Reflected XSS via unescaped slot name

Atro CSRF Middleware Bypass (security.checkOrigin)

Astros's duplicate trailing slash feature leads to an open redirection security issue

Astro Cloudflare adapter has Stored Cross-site Scripting vulnerability in /_image endpoint

Astro: Remote allowlist bypass via unanchored matchPathname wildcard

Astro's middleware authentication checks based on url.pathname can be bypassed via url encoded values

Astro vulnerable to URL manipulation via headers, leading to middleware and CVE-2025-61925 bypass