CVE-2026-73424 Astro: Unauthenticated path override in the @astrojs/vercel ISR function

Astro is a web framework for content-driven websites. From 10.0.3 until 11.0.3, the Astro Vercel adapter in packages/integrations/vercel/src/serverless/entrypoint.ts accepts xastropath for the public /isr function based only on the x-vercel-isr header, allowing unauthenticated GET requests to...

@a1st/aix (>=0.0.3, <=0.6.0), @a1st/aix-core (>=0.2.0, <=0.6.0) +9 more potentially affected by CVE-2026-73424 via @astrojs/vercel (>=10.0.6, <=10.0.8)

@astrojs/vercel NPM version =10.0.6, =0.0.3, =0.2.0, =0.0.11, =0.0.11, =0.0.11, =0.0.11, =0.0.11, =0.0.11, =0.0.11, =0.3.0 - taskair 0.0.1 Source cves: CVE-2026-73424 Source advisory: SNYK:JS-ASTROJSVERCEL-18599401...

@a1st/aix (>=0.0.3, <=0.6.0), @a1st/aix-core (>=0.2.0, <=0.6.0) +9 more potentially affected by CVE-2026-73424 via @astrojs/vercel (>=10.0.6, <=10.0.8)

@astrojs/vercel NPM version =10.0.6, =0.0.3, =0.2.0, =0.0.11, =0.0.11, =0.0.11, =0.0.11, =0.0.11, =0.0.11, =0.0.11, =0.3.0 - taskair 0.0.1 Source cves: CVE-2026-73424 Source advisory: OSV:GHSA-X27W-589X-FRM2...

Missing Authorization

Overview @astrojs/vercel is a Deploy your site to Vercel Affected versions of this package are vulnerable to Missing Authorization via the isr process. An attacker can access protected content by sending unauthenticated GET requests with a crafted xastropath query parameter, causing the server to...