CVE-2026-54299 Details
Description
Astro is a web framework. Prior to 6.4.6, Astro SSR apps with prerendered error pages (/404 or /500 using export const prerender = true) fetch those pages over HTTP at runtime when an error occurs. The URL for this fetch is derived from request.url, which in turn gets its origin from the incoming Host header. When the Host header is not validated against allowedDomains, an attacker can point the fetch at an arbitrary host and read the response. This vulnerability is fixed in 6.4.6.
A server-side request forgery (SSRF) vulnerability has been identified in the Astro web framework, affecting versions through 6.4.4. This issue arises in Astro server-side rendering (SSR) applications that use prerendered error pages, such as 404 or 500 pages, with the prerender option enabled. When an error occurs, these applications fetch the corresponding error page over HTTP. The fetch URL is derived from the request.url, which is influenced by the incoming Host header. If the Host header is not validated against allowedDomains, an attacker can redirect the fetch to an arbitrary host and read the response. This vulnerability is not present in Astro versions 6.4.6 and later, or in certain deployments using specific adapters or the development server.
Users can update to Astro version 6.4.6 or later, where this vulnerability has been fixed. For those using affected third-party adapters, consult the adapter's documentation for guidance on updating.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Jun 23, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/withastro/astro/security/advisories/GHSA-2pvr-wf23-7pc7 | [email protected] | MitigationVendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-20 | Improper Input Validation | [email protected] |
| CWE-918 | Server-Side Request Forgery (SSRF) | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| astro astro | < 6.4.6 |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 23, 2026 | CVE Modified | CISA-ADP |
| Jun 23, 2026 | Initial Analysis | [email protected] |
| Jun 22, 2026 | New CVE Received | [email protected] |