Description

Astro is a web framework for content-driven websites. From 10.0.3 until 11.0.3, the Astro Vercel adapter in packages/integrations/vercel/src/serverless/entrypoint.ts accepts x_astro_path for the public /_isr function based only on the x-vercel-isr header, allowing unauthenticated GET requests to render routes protected only by Vercel edge path rules or split edge middleware. This issue is fixed in 11.0.3.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.5",
  "pubDate": "2026-08-17T18:18:13.873Z",
  "pubdate": "2026-08-17T18:18:13.873Z",
  "executiveSummary": "An authentication bypass vulnerability exists within the Astro Vercel adapter, specifically affecting the public /_isr function located in packages/integrations/vercel/src/serverless/entrypoint.ts. The flaw allows unauthenticated attackers to execute arbitrary GET requests to render protected application routes.\nThe vulnerability affects Astro versions ranging from 10.0.3 up to, but not including, 11.0.3.\nThe core issue stems from insufficient validation of incoming request headers, where the component relies solely on the presence of the x-vercel-isr header to process the x_astro_path parameter.\nThis architectural oversight enables threat actors to bypass security controls implemented via Vercel edge path rules or split edge middleware. Consequently, sensitive resources intended to be restricted are exposed to unauthorized network access without requiring valid session credentials or elevated privileges.\nMitigation requires upgrading the affected Astro Vercel adapter package to version 11.0.3 or later where proper access controls and header validation are enforced.",
  "technicalDetails": "The vulnerability resides in the serverless entrypoint script of the Astro Vercel adapter, specifically implemented in packages/integrations/vercel/src/serverless/entrypoint.ts.\nThe affected versions include Astro releases from 10.0.3 through 11.0.3 (fixed in 11.0.3).\nThe root cause of the vulnerability is improper trust and validation of HTTP request headers. The endpoint handling the public /_isr function evaluates the incoming x-vercel-isr header to determine whether to process the x_astro_path parameter.\nBecause the validation logic depends entirely on a client-supplied or easily spoofed header rather than cryptographically verified internal Vercel routing metadata or robust authentication checks, unauthorized clients can supply the requisite header directly.\nThe attack flow proceeds as follows: An unauthenticated attacker crafts an HTTP GET request targeting the serverless ISR endpoint. The attacker injects the x-vercel-isr header alongside a target route specified in the x_astro_path parameter.\nThe vulnerable entrypoint processes this parameter without verifying whether the request originated from legitimate Vercel edge infrastructure or if the caller possesses authorization to access the requested resource.\nAs a result, the application renders and returns routes that are otherwise protected by Vercel edge path rules or split edge middleware configurations.\nThe exploitation vector requires network exposure to the deployed serverless functions and the ability to issue arbitrary HTTP GET requests containing specific header configurations.\nNo authentication or privilege requirements are enforced by the vulnerable component itself for this code path, allowing anonymous external entities to successfully interact with the internal rendering pipeline.\nThe post-exploitation impact includes unauthorized disclosure of protected content, exposure of sensitive application views, and potential circumvention of higher-level edge security controls designed to restrict perimeter access."
}