CVE-2026-73424 Astro: Unauthenticated path override in the @astrojs/vercel ISR function
Unauthenticated attackers can bypass Vercel edge path rules to access protected routes via the ISR function in the Astro Vercel adapter.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-73424?
CVE-2026-73424 is a medium-severity missing authorization vulnerability in withastro astro, published on 17 Aug 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Astro is a web framework for content-driven websites. From 10.0.3 until 11.0.3, the Astro Vercel adapter in packages/integrations/vercel/src/serverless/entrypoint.ts accepts x_astro_path for the public /_isr function based only on the x-vercel-isr header, allowing unauthenticated GET requests to render routes protected only by Vercel edge path rules or split edge middleware. This issue is fixed in 11.0.3.
Which versions are affected by CVE-2026-73424?
2 open source packages ship an affected version, including @astrojs/vercel.
| Package | Affected | Fixed in |
|---|---|---|
@astrojs/vercel npm | From 10.0.3 | 11.0.3 |
@astrojs/vercel npm | From 10.0.3 | 11.0.3 |
How do I fix CVE-2026-73424?
Upgrade @astrojs/vercel to 11.0.3 or later.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2026-73424 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-73424 exists.
Sources
Also known as GHSA-x27w-589x-frm2.