Astro @astrojs/vercel ISR Path Overwrite Unauthenticated Access Vulnerability

Vulnerability Overview An unauthenticated path traversal vulnerability exists in the ISR (Incremental Static Regeneration) function of . When ISR is enabled, serverless endpoints allow unauthenticated requests to determine which route is rendered from the source. The internal function reads the query parameter and rewrites the request path without any authentication. Edge-level access control only inspects the path and does not apply to the actual fetched route. Scope Affected Versions: >= 10.0.3 Fixed Versions: 11.0.3 CVE ID: CVE-2026-73424 Weaknesses: - CWE-441 - CWE-862 Credit: jp-soba (Reporter) Impact This vulnerability affects applications using with configured to protect edge routes. Two common configurations are affected: 1. Path rules or firewall deny rules configured on Vercel (e.g., blocking ). 2. Split deployments ( ), where authorization resides in Astro middleware because the middleware runs at the edge while the source does not. An attacker can read any GET-rendered route by requesting . No credentials are required. The protected content is generated by rendering from the new source, so the attack does not rely on the response being cached first. Details The function in selects the real path as follows: The header path is protected by a build-time secret, which is secure. The ISR branch is not. Two facts make it accessible to anyone: 1. The function is publicly addressable. 2. Vercel sets on the request, so the attacker does not even need to send this header. Consequently, sets the internal path to and renders it. The edge only sees , which is allowed, so no path-based rules are triggered for . In split deployments, edge middleware also runs against , while the source does not run middleware at the edge, so middleware-based authentication is bypassed as well. Regression Cause CVE-2026-33768 was fixed in version 10.0.2 via commit 338a34 (PR #15959), which required a secret for path overrides and removed the query parameter source. Commit aa26838 (PR #16073), titled "Fix ISR path rewrites to prevent 404s," brought back the query parameter, protected only by the header. This header is not a security boundary, so the fix effectively reverted for ISR routes in version 10.0.3. Notably, the original report considered Edge Middleware as a mitigation and limited the issue to deployments without it. Here, in split deployments, Edge Middleware is bypassed, so the attacker reaches directly, the middleware only sees , and the source runs at the origin. Proof of Concept 1. Create an Astro application with and the adapter. 2. Add an page that returns sensitive content. 3. Deny at the edge, for example, using a Vercel Path Rule returning a 403, or middleware authentication checks in a split ( ) build. 4. Request . It is blocked (403). 5. Request . It returns 200 with admin content. The response header confirms it was newly rendered, not served from an existing cache entry. Not Affected 1. Classic (non-split) middleware. It runs inside the source against the rewritten path, so it still applies to the target route. 2. State-changing requests. Vercel serves the ISR function only for GET requests and returns 403 for POST, PUT, and DELETE, so method-based variant CVE-2026-33768 will not reproduce here. The impact is limited to reading (confidentiality). 3. Whole-deployment protection (Vercel SSO or password), which also covers . Severity Unauthenticated read of any GET-rendered route that is protected only at the edge. There is no integrity or availability impact, as the vector is GET-only. Recommended Fix One option is to require a secret for path overrides, as done in PR #15959, so that the ISR branch stops trusting client-provided . The 404 fix in PR #16073 would require an alternative approach that does not rely on client input. References https://nvd.nist.gov/vuln/detail/CVE-2026-33768 GHSA-mr6q-r889-fx84 PR #15959 (commit 338a34) PR #16073 (commit aa26838)

Goal Reached Thanks to every supporter — we hit 100%!

Astro @astrojs/vercel ISR Path Overwrite Unauthenticated Access Vulnerability

More from this source