Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
Astro is a web framework. Prior to version 10.0.2, the @astrojs/vercel serverless entrypoint reads the x-astro-path header and x_astro_path query parameter to rewrite the internal request path, with no authentication whatsoever. On deployments without Edge Middleware, this lets anyone bypass Vercel's platform-level path restrictions entirely. The override preserves the original HTTP method and body, so this isn't limited to GET. POST, PUT, DELETE all land on the rewritten path. A Firewall rule blocking /admin/* does nothing when the request comes in as POST /api/health?x_astro_path=/admin/delete-user. This issue has been patched in version 10.0.2.
Priority
LOW
Exploitation
NONE
PoC
YES
Patch
AVAILABLE
Momentum
STABLE
If you run products in this scope, you should treat this CVE as relevant to your environment.
| Date | Total | Labels |
|---|
| 2026-03-24 | 1 | Disclosure1 |
| 2026-03-25 | 1 | Patch1 |
Webフレームワーク「Astro」において、特定条件においてVercelのプラットフォームレベルのファイアウォールを回避可能な脆弱性を報告し、修正されました。（CVE-2026-33768） 私の初CVEです！ Astroは私もお世話になっているフレームワークなので、貢献できたことはとても嬉しく思います。 今後も、お世話になっているOSSには積極的に貢献していきます！ https://github.com/withastro/astro/security/advisories/GHSA-mr6q-rp88-fx84
Post summary
The advisory announces that a firewall‑bypass vulnerability (CVE‑2026‑33768) in Astro has been discovered and fixed, with no PoC or active exploitation evidence shared.
🚨 CYBERDUDEBIVASH SENTINEL APEX ALERT 🚨 Threat: CVE-2026-33768 - Astro: Unauthenticated Path Override via `x-astro-path` / `x_astro_path` Intel Report: https://ift.tt/cZpXPzI
Post summary
The alert announces CVE-2026-33768, a path override vulnerability in Astro, without evidence of active exploitation, mitigations, or a proof of concept.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | astro | \@astrojs\/vercel | - | - | - |