PT-2026-27487 · Astro · Astro+1

Jp-Soba · Published 2026-03-24 · Updated 2026-03-26 · CVE-2026-33768

Positive Technologies (AI Summary)

CVSS v3.1

9.1

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions Astro versions prior to 10.0.2

Description Astro, a web framework, contains a flaw in the @astrojs/vercel serverless entrypoint. Versions prior to 10.0.2 do not authenticate requests using the x-astro-path header or x astro path query parameter, allowing attackers to bypass Vercel's path restrictions. This bypass affects all HTTP methods, including POST, PUT, and DELETE, as the original method and body are preserved. An example of exploitation involves bypassing firewall rules by sending a request to /api/health with the x astro path parameter set to a restricted path, such as /admin/delete-user.

Recommendations Update to Astro version 10.0.2 or later.

Exploit

Fix

Missing Authorization

Weakness Enumeration

CWE-862

CWE-441

Related Identifiers

CVE-2026-33768

GHSA-MR6Q-RP88-FX84

Affected Products

@Astrojs/Vercel

Astro

References · 12

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/33xxx/CVE-2026-33768.json · Exploit
• https://github.com/withastro/astro/security/advisories/GHSA-mr6q-rp88-fx84 · Vendor Advisory
• https://github.com/withastro/astro/commit/335a204161f5a7293c128db570901d4f8639c6ed · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-33768 · Security Note
• https://osv.dev/vulnerability/CVE-2026-33768 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-mr6q-rp88-fx84 · Vendor Advisory
• https://github.com/withastro/astro · Note
• https://github.com/withastro/astro/releases/tag/@astrojs/vercel@10.0.2 · Note
• https://github.com/withastro/astro/pull/15959 · Note
• https://github.com/withastro/astro/releases/tag/%40astrojs%2Fvercel%4010.0.2 · Note
• https://github.com/advisories/GHSA-f82v-jwr5-mffw · Note
• https://twitter.com/cyberbivash/status/2036545819063488957 · Twitter Post