CVE-2026-54299
published 2026-06-22CVE-2026-54299: Astro is a web framework. Prior to 6.4.6, Astro SSR apps with prerendered error pages (/404 or /500 using export const prerender = true) fetch those pages over…
PriorityP344high7.5CVSS 3.1
AVNACLPRNUINSUCHINAN
EPSS
0.20%
9.5th percentile
Astro is a web framework. Prior to 6.4.6, Astro SSR apps with prerendered error pages (/404 or /500 using export const prerender = true) fetch those pages over HTTP at runtime when an error occurs. The URL for this fetch is derived from request.url, which in turn gets its origin from the incoming Host header. When the Host header is not validated against allowedDomains, an attacker can point the fetch at an arbitrary host and read the response. This vulnerability is fixed in 6.4.6.
Affected
3 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| astro | astro | < 6.4.6 | 6.4.6 |
| astro | astro | >= 0 < 6.4.6 | 6.4.6 |
| withastro | astro | < 6.4.6 | 6.4.6 |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
VulDB
withastro up to 6.4.5 Host Header request.url input validation (EUVD-2026-38337)
vuldb·2026-06-22·CVSS 7.5
CVE-2026-54299 [HIGH] withastro up to 6.4.5 Host Header request.url input validation (EUVD-2026-38337)
A vulnerability classified as problematic has been found in withastro astro up to 6.4.5. This impacts the function request.url of the component Host Header Handler. Performing a manipulation results in improper input validation.
This vulnerability is reported as CVE-2026-54299. The attack is possible to be carried out remotely. No exploit exists.
It is recommended to upgrade the affected component.
GHSA
Astro: Host header SSRF in prerendered error page fetch
ghsa·2026-06-16
CVE-2026-54299 [HIGH] CWE-20 Astro: Host header SSRF in prerendered error page fetch
Astro: Host header SSRF in prerendered error page fetch
## Summary
Astro SSR apps with prerendered error pages (`/404` or `/500` using `export const prerender = true`) fetch those pages over HTTP at runtime when an error occurs. The URL for this fetch is derived from `request.url`, which in turn gets its origin from the incoming `Host` header. When the `Host` header is not validated against `allowedDomains`, an attacker can point the fetch at an arbitrary host and read the response.
## Who is affected
This affects SSR deployments that:
1. Have a prerendered 404 or 500 page
2. Use `createRequestFromNodeRequest` from `astro/app/node` with `app.render()` **without** overriding `prerenderedErrorPageFetch` — this includes custom servers built on the public API and third-party adapters
**N
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2026-06-22
Published