EUVD-2026-14962

Astro: Memory exhaustion DoS due to missing request body size limit in Server Islands...

CVE-2026-33768 Astro: Unauthenticated Path Override via `x-astro-path` / `x_astro_path`

Astro is a web framework. Prior to version 10.0.2, the @astrojs/vercel serverless entrypoint reads the x-astro-path header and xastropath query parameter to rewrite the internal request path, with no authentication whatsoever. On deployments without Edge Middleware, this lets anyone bypass Vercel...

EUVD-2025-33766

Astro's X-Forwarded-Host is reflected without validation...