CVE-2026-73424: Astro Remote Code Execution Vulnerability

{
  "schema_version" : "1.4.0",
  "id" : "GHSA-x27w-589x-frm2",
  "modified" : "2026-08-17T17:12:10Z",
  "published" : "2026-07-20T23:25:07Z",
  "aliases" : [ "CVE-2026-73424" ],
  "summary" : "Astro: Unauthenticated path override in the @astrojs/vercel ISR function",
  "details" : "## Summary\nWhen ISR is enabled, the serverless entrypoint lets an unauthenticated request\ndecide which route the origin renders. The internal `_isr` function reads the\n`x_astro_path` query parameter and rewrites the request path to it without any\nauthentication. Edge level access controls only ever see the `/_isr` path, so\nthey do not apply to the route that actually gets rendered. This is the same\nconfused deputy problem as CVE-2026-33768, reachable again through the ISR path.\n\n## Impact\nThis affects apps that use `@astrojs/vercel` with `isr: true` and protect routes\nat the edge. Two common setups are affected:\n\n1. Path rules or firewall deny rules configured on Vercel (for example blocking\n   `/admin`).\n2. Split deployments (`edgeMiddleware: true`) where authorization lives in Astro\n   middleware, since that middleware runs at the edge and not in the origin.\n\nAn attacker reads any GET rendered route by requesting\n`/_isr?x_astro_path=/the/protected/path`. No credentials are required. The\nprotected content is produced by a fresh origin render, so the attack does not\ndepend on the response being cached first.\n\n## Details\n`packages/integrations/vercel/src/serverless/entrypoint.ts` picks the real path\nlike this:\n\n```js\nif (hasValidMiddlewareSecret) {\n  realPath = request.headers.get(ASTRO_PATH_HEADER);       // secret checked\n} else if (request.headers.get('x-vercel-isr') === '1') {\n  realPath = url.searchParams.get(ASTRO_PATH_PARAM);        // no secret checked\n}\n```\n\nThe header path is gated by the per build secret and is fine. The ISR branch is\nnot. Two facts make it reachable by anyone:\n\n1. The `_isr` function is publicly addressable.\n2. Vercel sets `x-vercel-isr: 1` on requests to it, including direct external\n   requests, so the attacker does not even need to send that header.\n\nSo `GET /_isr?x_astro_path=/admin` sets the internal path to `/admin` and renders\nit. The edge saw only `/_isr`, which is allowed, so any path based rule on\n`/admin` never fires. In split deployments the edge middleware also runs against\n`/_isr`, and the origin does not run middleware at all, so middleware based auth\nis skipped as well.\n\n## How this regressed\nCVE-2026-33768 was fixed in 10.0.2 by commit 335a204161 (PR #15959), which\nrequired the secret for every path override and removed the query parameter\nsource. Commit aa266364fe (PR #16079, \"Fix ISR path rewrite to prevent 404\")\nbrought the query parameter back, guarded only by the `x-vercel-isr` header. That\nheader is not a security boundary, so the fix was effectively undone for ISR\nroutes starting in 10.0.3.\n\nWorth noting the contrast: the original report treated Edge Middleware as the\nmitigation and scoped the issue to deployments without it. Here, for split\ndeployments, Edge Middleware is bypassed too, since the attacker reaches `/_isr`\ndirectly and the middleware only sees `/_isr` while the origin runs none.\n\n## Proof of concept\n1. Create an Astro app with `output: 'server'` and adapter\n   `vercel({ isr: true })`.\n2. Add a page at `/admin` that returns sensitive content.\n3. Deny `/admin` at the edge, for example a Vercel path rule that returns 403, or\n   a middleware auth check in a split (`edgeMiddleware: true`) build.\n4. Request `/admin`. It is blocked (403).\n5. Request `/_isr?x_astro_path=/admin`. It returns 200 with the admin content.\n   The response header `X-Vercel-Cache: MISS` confirms it was rendered fresh, not\n   served from an existing cache entry.\n\n## What is not affected\n1. Classic (non split) middleware. It runs inside the origin against the rewritten\n   path, so it still applies to the target route.\n2. State changing requests. Vercel serves ISR functions for GET only, and returns\n   403 for POST, PUT and DELETE, so the method preserving variant of CVE-2026-33768\n   does not reproduce here. Impact is limited to reading (confidentiality).\n3. Whole deployment protection (Vercel SSO or password), which also covers `/_isr`.\n\n## Severity\nUnauthenticated read of any GET rendered route that is protected only at the edge.\nNo integrity or availability impact because the vector is GET only.\n\n## Suggested fix\nOne option would be to require the secret again for path overrides, the way\nPR #15959 did, so the ISR branch stops trusting the client supplied `x_astro_path`.\nThe 404 that PR #16079 was fixing would then need another approach that does not\nrely on client input.",
  "severity" : [ {
    "type" : "CVSS_V3",
    "score" : "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N"
  } ],
  "affected" : [ {
    "package" : {
      "ecosystem" : "npm",
      "name" : "@astrojs/vercel"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "10.0.3"
      }, {
        "fixed" : "11.0.3"
      } ]
    } ]
  } ],
  "references" : [ {
    "type" : "WEB",
    "url" : "https://github.com/withastro/astro/security/advisories/GHSA-mr6q-rp88-fx84"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/withastro/astro/security/advisories/GHSA-x27w-589x-frm2"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/withastro/astro/pull/16079"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/withastro/astro/pull/17370"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/withastro/astro/commit/3a43cf0f3690a8e33cb30109bc5165611cf38fcd"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/withastro/astro/commit/aa266364fe9e105317b66e218fe04567307fb57f"
  }, {
    "type" : "PACKAGE",
    "url" : "https://github.com/withastro/astro"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/withastro/astro/releases/tag/@astrojs/vercel@11.0.3"
  } ],
  "database_specific" : {
    "cwe_ids" : [ "CWE-441", "CWE-862" ],
    "severity" : "MODERATE",
    "github_reviewed" : true,
    "github_reviewed_at" : "2026-07-20T23:25:07Z",
    "nvd_published_at" : null
  }
}