@chocolatey-software/astro (>=2.0.0, <=2.5.0), choco-astro (>=0.3.1, <=0.4.0) potentially affected by CVE-2026-27829 via @astrojs/node (>=9.2.2, <=9.5.2)

@astrojs/node NPM version =9.2.2, =2.0.0, =0.3.1, =0.4.0 Source cves: CVE-2026-27829 Source advisory: GHSA-CJ9F-H6R6-4CX2...

@chocolatey-software/astro (>=2.0.0, <=2.5.0), choco-astro (>=0.3.1, <=0.4.0) potentially affected by CVE-2026-27729 via @astrojs/node (>=9.2.2, <=9.5.2)

@astrojs/node NPM version =9.2.2, =2.0.0, =0.3.1, =0.4.0 Source cves: CVE-2026-27729 Source advisory: MEND:CVE-2026-27729...

@ayco/astro-resume (>=0.3.0, <=0.3.2), @ayco/cozy (>=0.2.5, <=0.3.1) +32 more potentially affected by CVE-2026-25545 via @astrojs/node (>=0.1.6, <=9.5.2)

@astrojs/node NPM version =0.1.6, =0.3.0, =0.2.5, =1.0.0, =2.0.0, =0.40.5, =0.0.51, =0.0.51, =0.7.0, =0.1.0, =0.0.1, =0.2.1, =0.0.2, =0.0.5 and more Source cves: CVE-2026-25545 Source advisory: MEND:CVE-2026-25545...

@chocolatey-software/astro (>=2.0.0, <=2.5.0), choco-astro (>=0.3.1, <=0.4.0) potentially affected by CVE-2026-25545 via @astrojs/node (>=9.2.2, <=9.5.2)

@astrojs/node NPM version =9.2.2, =2.0.0, =0.3.1, =0.4.0 Source cves: CVE-2026-25545 Source advisory: OSV:GHSA-QQ67-MVV5-FW3G...

@chocolatey-software/astro (>=2.0.0, <=2.5.0), choco-astro (>=0.3.1, <=0.4.0) potentially affected by CVE-2026-25545 via @astrojs/node (>=9.2.2, <=9.5.2)

@astrojs/node NPM version =9.2.2, =2.0.0, =0.3.1, =0.4.0 Source cves: CVE-2026-25545 Source advisory: GHSA-QQ67-MVV5-FW3G...

Relative Path Traversal

Overview @astrojs/node is a Deploy your site to a Node.js server Affected versions of this package are vulnerable to Relative Path Traversal via the href parameter in the image optimization endpoint during development mode. An attacker can access arbitrary local image files readable by the Node.j...

choco-astro (>=0.3.1, <=0.4.0) potentially affected by CVE-2025-64757 via @astrojs/node (>=9.2.2, <=9.3.0)

@astrojs/node NPM version =9.2.2, =0.3.1, =0.4.0 Source cves: CVE-2025-64757 Source advisory: SNYK:JS-ASTROJSNODE-14059141...

Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection')

Overview @astrojs/node is a Deploy your site to a Node.js server Affected versions of this package are vulnerable to Use of Externally-Controlled Input to Select Classes or Code 'Unsafe Reflection' via the X-Forwarded-Host header when using the Astro.url property without validation. An attacker c...

choco-astro (>=0.3.1, <=0.4.0) potentially affected by CVE-2025-61925 via @astrojs/node (>=9.2.2, <=9.3.0)

@astrojs/node NPM version =9.2.2, =0.3.1, =0.4.0 Source cves: CVE-2025-61925 Source advisory: SNYK:JS-ASTROJSNODE-13535086...

Open Redirection

@astrojs/node is vulnerable to Open Redirection. The vulnerability is due to incorrect handling of double slashes with the Node deployment adapter in standalone mode and trailingSlash set to "always," allowing attackers to redirect users to malicious domains...

@ayco/astro-resume (>=0.3.0, <=0.3.2), @ayco/cozy (>=0.2.5, <=0.3.1) +30 more potentially affected by CVE-2025-55303 via @astrojs/node (>=0.1.6, <=8.3.4)

@astrojs/node NPM version =0.1.6, =0.3.0, =0.2.5, =1.0.0, =0.40.5, =0.0.51, =0.0.51, =0.7.0, =0.1.0, =0.0.1, =0.2.1, =0.0.2, =0.0.5 - @spotlightjs/spotlight-astro-playground 0.0.0 and more Source cves: CVE-2025-55303 Source advisory: MEND:CVE-2025-55303...

choco-astro (>=0.3.1, <=0.4.0) potentially affected by CVE-2025-55207 via @astrojs/node (>=9.2.2, <=9.3.0)

@astrojs/node NPM version =9.2.2, =0.3.1, =0.4.0 Source cves: CVE-2025-55207 Source advisory: GHSA-9X9C-GHC5-JHW9...

choco-astro (>=0.3.1, <=0.4.0) potentially affected by CVE-2025-55207 via @astrojs/node (>=9.2.2, <=9.3.0)

@astrojs/node NPM version =9.2.2, =0.3.1, =0.4.0 Source cves: CVE-2025-55207 Source advisory: OSV:GHSA-9X9C-GHC5-JHW9...

Open Redirect

Overview @astrojs/node is a Deploy your site to a Node.js server Affected versions of this package are vulnerable to Open Redirect via the trailingSlash configuration in standalone mode with the Node deployment adapter. An attacker can redirect users to external sites by crafting URLs with double...

choco-astro (>=0.3.1, <=0.4.0) potentially affected by CVE-2025-55207 via @astrojs/node (>=9.2.2, <=9.3.0)

@astrojs/node NPM version =9.2.2, =0.3.1, =0.4.0 Source cves: CVE-2025-55207 Source advisory: SNYK:JS-ASTROJSNODE-11951436...

@ayco/astro-resume (>=0.3.0, <=0.3.2), @ayco/cozy (>=0.2.5, <=0.3.1) +31 more potentially affected by CVE-2025-55207 via @astrojs/node (>=0.1.6, <=9.3.0)

@astrojs/node NPM version =0.1.6, =0.3.0, =0.2.5, =1.0.0, =0.40.5, =0.0.51, =0.0.51, =0.7.0, =0.1.0, =0.0.1, =0.2.1, =0.0.2, =0.0.5 - @spotlightjs/spotlight-astro-playground 0.0.0 and more Source cves: CVE-2025-55207 Source advisory: MEND:CVE-2025-55207...