Blog

withastro/astro

The web framework for content-driven websites. ⭐️ Star to support our work!

#static-site-generator#blog#islands#components#node#browser#server#hybrid#universal#astro#static

スコア

/ 100

Star

59,319

Fork

3,448

Open Issue

101

サイズ

219MB

言語

TypeScript ★

最終push

0 日前

Docker

—

採点内訳

過去CVE 19件 (やや多い)

✓

直近 push: 0 日前

✓

得意言語 (TypeScript)

✓

オープンissue 101件

✓

大規模 (219MB)

—

Docker 未対応

—

50k–100k: 上級 (★59,319)

—

※ 各項目の重みは「採点ルール」を参照。合計は 0 で底打ち。

過去の SecurityAdvisory (20 件)

LOWGHSA-xr5h-phrj-8vxv CVE-2026-450282026/5/7
Server island encrypted parameters vulnerable to cross-component replay
LOWGHSA-88gm-j2wx-58h6 CVE-2026-413212026/4/20
SSRF via redirect following in Cloudflare image-binding-transform endpoint (incomplete fix for GHSA-qpr4)
MEDIUMGHSA-j687-52p2-xcff CVE-2026-410672026/4/20
XSS via incomplete `</script>` sanitization in `define:vars` allows case-insensitive and whitespace-based bypass
MEDIUMGHSA-c57f-mm3j-27q9 CVE-2026-413222026/4/20
Cache Poisoning due to incorrect error handling when if-match header is malformed
MEDIUMGHSA-mr6q-rp88-fx84 CVE-2026-337682026/3/24
Unauthenticated Path Override via `x-astro-path` / `x_astro_path`
MEDIUMGHSA-3rmj-9m5h-8fpv CVE-2026-297722026/3/24
Memory exhaustion DoS due to missing request body size limit in Server Islands
LOWGHSA-g735-7g2w-hh3f CVE-2026-337692026/3/24
Remote allowlist bypass via unanchored matchPathname wildcard
MEDIUMGHSA-qq67-mvv5-fw3g CVE-2026-255452026/2/23
Full-Read SSRF in error rendering via Host: header injection
MEDIUMGHSA-jm64-8m5q-4qh8 CVE-2026-277292026/2/23
Memory exhaustion DoS due to missing request body size limit in Server Actions
MEDIUMGHSA-cj9f-h6r6-4cx2 CVE-2026-278292026/2/23
SSRF due to missing allowlist enforcement in remote image inferSize
MEDIUMGHSA-whqg-ppgf-wp8c CVE-2025-662022025/12/6
bypass for CVE-2025-64765
MEDIUMGHSA-fvmw-cj7j-j39q CVE-2025-650192025/11/19
Cross Site Scripting in /_image endpoint in Astro Cloudflare adapter
LOWGHSA-x3h8-62x9-952g CVE-2025-647572025/11/19
Arbitrary Local File Read in Astro Development Server
MEDIUMGHSA-ggxq-hp9w-j794 CVE-2025-647652025/11/19
Middleware authentication checks based on url.pathname can be bypassed via url encoded values
HIGHGHSA-wrwg-2hg8-v723 CVE-2025-647642025/11/19
Reflected XSS via the server islands feature
LOWGHSA-w2vj-39qv-7vh7 CVE-2025-647452025/11/13
Reflected XSS in Astro development server error page
MEDIUMGHSA-hr2q-hp5q-x767 CVE-2025-645252025/11/13
URL manipulation via unsanitized headers leads to path-based middleware protections bypass and potential SSRF/cache-poisoning + CVE-2025-61925 bypass
HIGHGHSA-qcpr-679q-rhm2 CVE-2025-598372025/10/28
Bypass of image proxy domain validation (CVE-2025-58179) - SSRF and potential XSS
HIGHGHSA-j47w-4mr3-8gq62025/10/28
Validate Changesets workflow vulnerable to arbitrary code execution
MEDIUMGHSA-5ff5-9fcw-vg88 CVE-2025-619252025/10/10
`X-Forwarded-Host` reflected with no validation