GHSA-mr6q-rp88-fx84
Medium · 6.5CVSS
6.5
EPSS
—
Published
Mar 26, 2026
CISA due date
—
The record
Astro: Unauthenticated Path Override via `x-astro-path` / `x_astro_path`
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| npm | @astrojs/vercel | 0 | 10.0.2 |
Related vulnerabilities
- CVE-2026-33768 Astro is a web framework. Same vulnerability
- CVE-2026-101907 Axios is a promise-based HTTP client for the browser and Node.js. CWE-441
- CVE-2026-101905 Axios is a promise-based HTTP client for the browser and Node.js. CWE-441
- CVE-2026-86003 CoreDNS is a DNS server written in Go. CWE-441
- CVE-2026-87582 Confused deputy in DataTransfer in Google Chrome prior to 153.0.8010.36 allowed a remote… CWE-441
- CVE-2026-87502 Confused deputy in Fullscreen in Google Chrome prior to 153.0.8010.36 allowed a remote… CWE-441
- CVE-2026-87453 Confused deputy in BackgroundFetch in Google Chrome prior to 153.0.8010.36 allowed a… CWE-441
- CVE-2026-87442 Confused deputy in Prerender in Google Chrome prior to 153.0.8010.36 allowed a remote… CWE-441