How many CVEs have a located fix in withastro/astro?

34 published CVEs have a fix traced to functions in withastro/astro, touching 93 functions across 60 files.

Which function in withastro/astro has been patched by the most CVEs?

loadRemoteImage in packages/astro/src/assets/endpoint/shared.ts has been changed by 3 CVE fixes, from 2025 to 2026.

How large is a typical CVE fix in withastro/astro?

The median fix changes 32 lines. 38% of fixes change 20 lines or fewer, and 29% change a single function.

How is a fix located to a function?

The upstream fix commit for each CVE is fetched and its diff is split into hunks. Each hunk is attributed to the function, method or type it changes, using the definition the diff itself names. Backports of the same fix to stable branches are counted once.

RadicalNotion.AI

Log in Create an account

typescript

#133 of 500 repositories

withastro/astro

Name: withastro/astro: functions patched by CVE fixes
Creator: RadicalNotion.AI
License: https://creativecommons.org/licenses/by-nc/4.0/

Functions and files changed by CVE fixes in this repository.

Latest located fix September 30, 2026

34

CVE fixes located

Published CVEs

93

Functions patched

Distinct function sites

60

Files patched

Distinct source files

2024–2026

Years covered

By CVE publication date

Overview

34 published CVEs have a fix traced to functions in withastro/astro, the earliest published in 2024. Those fixes changed 93 distinct functions across 60 files, in 328 patch hunks.

Among the 500 repositories tracked here, withastro/astro ranks #133 by the number of CVEs with a located fix.

Most patched functions

Functions in withastro/astro changed by the most CVE fixes.

Most patched files

Files in withastro/astro changed by the most CVE fixes.

1packages/internal-helpers/src/path.ts7 CVEs · 8 functions
2packages/astro/src/core/app/node.ts3 CVEs · 5 functions
3packages/astro/src/types/public/config.ts3 CVEs · 4 functions
4packages/astro/src/core/app/index.ts3 CVEs · 3 functions
5packages/astro/src/assets/endpoint/generic.ts3 CVEs · 1 functions
6packages/astro/src/assets/endpoint/shared.ts3 CVEs · 1 functions
7packages/integrations/cloudflare/src/entrypoints/image-endpoint.ts3 CVEs · 0 functions
8packages/astro/src/actions/runtime/server.ts2 CVEs · 4 functions
9packages/astro/src/vite-plugin-astro-server/plugin.ts2 CVEs · 3 functions
10packages/integrations/netlify/src/index.ts2 CVEs · 3 functions

Fix size

How much code a CVE fix in withastro/astro changes, with backports counted once.

32

Median lines changed

Added plus removed, per CVE

38%

Fixes of 20 lines or fewer

Share of CVE fixes

29%

Fixes in a single function

Share of CVE fixes

Latest CVEs

The most recently published CVEs with a fix located in withastro/astro, and the functions each fix changed.

Astro: Malformed port in the Host header can crash the Node adapter
CVE-2026-102984buildRequestUrl createRequest parseHost
High · CVSS 8.2
EPSS 0.4%2026-09-30
Astro: Netlify Image CDN allowlist bypass enables SSRF
CVE-2026-102983remoteImagesFromAstroConfig remotePatternToRegex
Medium · CVSS 6.3
EPSS 0.3%2026-09-30
Astro: Authorization bypass from missing path-segment boundary check when stripping the configured base
CVE-2026-84376removeBase stripRequestBase FetchState
Medium · CVSS 6.3
EPSS 0.7%2026-09-02
Astro: Unauthenticated path override in the @astrojs/vercel ISR function
CVE-2026-73424calls vercelAdapter VercelBuilder
Medium · CVSS 6.5
EPSS 0.4%2026-08-17
@astrojs/netlify generates an overly-broad Netlify Image CDN allowlist because remotePatterns.pathname metacharacters are not escaped
CVE-2026-73425remotePatternToRegex escapeRegex remoteImagesFromAstroConfig
Low · CVSS 3.7
EPSS 0.3%2026-08-12
Astro: composable `astro/hono` pipeline bypasses `security.checkOrigin` when `middleware()` is absent or misordered
CVE-2026-73423in PagesHandler ActionHandler
Medium · CVSS 5.1
EPSS 0.3%2026-08-12
Astro: Reflected XSS via unescaped View Transition animation properties
CVE-2026-73422ServerIslandComponent escapeStyleText incrementTransitionNumber
Medium · CVSS 5.3
EPSS 0.5%2026-08-12
@astrojs/node: Backslash-prefixed paths not recognized as internal by trailing-slash redirect
CVE-2026-59730isInternalPath
Low · CVSS 2.1
EPSS 0.5%2026-07-27
@astrojs/rss: XML Injection via Unescaped RSS Feed Fields
CVE-2026-59728generateRSS
Medium · CVSS 4.3
EPSS 0.4%2026-07-27
Astro: Cross-site scripting via unescaped transition:* directive values on hydrated islands
CVE-2026-59727generateHydrateScript
Low · CVSS 2.1
EPSS 0.5%2026-07-27
Astro: XSS via unescaped spread attribute names in renderHTMLElement (incomplete fix for CVE-2026-54298)
CVE-2026-59729renderHTMLElement componentIsHTMLElement
Medium · CVSS 5.1
EPSS 0.5%2026-07-27
Astro 6.4.7 Authorization Bypass via Decode Iteration Limit and Rewrite Path Canonicalization Mismatch
CVE-2026-59731MultiLevelEncodingError validateAndDecodePathname FetchState
High · CVSS 8.2
EPSS 0.5%2026-07-08

Get an alert for each new withastro/astro CVE, with the patched functions and AI-written analysis.

Monitor astro CVEs

Other repositories

Repositories with a similar number of located CVE fixes.

Cacti/cacti34 CVEs curl/curl34 CVEs libtiff/libtiff34 CVEs mastodon/mastodon34 CVEs sooperset/mcp-atlassian34 CVEs AcademySoftwareFoundation/openexr35 CVEs bigbluebutton/bigbluebutton35 CVEs debian/imagemagick35 CVEs

Browse all repositories

Frequently asked questions

Common questions about CVE fixes in withastro/astro.

How many CVEs have a located fix in withastro/astro?: 34 published CVEs have a fix traced to functions in withastro/astro, touching 93 functions across 60 files.
Which function in withastro/astro has been patched by the most CVEs?: loadRemoteImage in packages/astro/src/assets/endpoint/shared.ts has been changed by 3 CVE fixes, from 2025 to 2026.
How large is a typical CVE fix in withastro/astro?: The median fix changes 32 lines. 38% of fixes change 20 lines or fewer, and 29% change a single function.
How is a fix located to a function?: The upstream fix commit for each CVE is fetched and its diff is split into hunks. Each hunk is attributed to the function, method or type it changes, using the definition the diff itself names. Backports of the same fix to stable branches are counted once.

References

Fix locations are computed by RadicalNotion.AI from the upstream patch diff of each CVE. CVE data is sourced from the CVE Program.

Track withastro/astro CVEs

Get an alert when a new CVE lands in this repository, with the patched functions and AI-written remediation guidance.

Create an account See pricing