CVE-2026-73424: Astro is a web framework for content-driven websites. From 10.0.3 until 11.0.3, the Astro Vercel adapter in…

PriorityP338medium6.5CVSS 3.1

AVNACLPRNUINSUCLILAN

EPSS

0.27%

20.1th percentile

Astro is a web framework for content-driven websites. From 10.0.3 until 11.0.3, the Astro Vercel adapter in packages/integrations/vercel/src/serverless/entrypoint.ts accepts x_astro_path for the public /_isr function based only on the x-vercel-isr header, allowing unauthenticated GET requests to render routes protected only by Vercel edge path rules or split edge middleware. This issue is fixed in 11.0.3.

Affected

1 ranges

Vendor	Product	Version range	Fixed in
withastro	astro	—	—

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.