Frontend framework
Astro: latest release and open vulnerabilities today
The latest release of the astro package is 7.4.0. 6 high or critical advisories for the astro package were published in the last 12 months; none of its advisories is on CISA’s list of exploited vulnerabilities.
Last checked against npm, OSV.dev, CISA KEV, FIRST EPSS and deps.dev.
- Latest astro release
- 7.4.0
- npm downloads last week
- 7.3M
- GitHub stars
- 63.1k
- Licence
- MIT
Security advisories
21 advisories published in the last 12 months, 6 of them high or critical. 27 in total since records began. Checked packages: astro.
Astro: Remote code execution through AVIF image optimization
Fixed in 7.2.8.
Astro: Authorization Bypass via Decode Iteration Limit and Rewrite Path Canonicalization Mismatch
Fixed in 6.4.8.
EPSS: top 62%Astro: Host header SSRF in prerendered error page fetch
Fixed in 6.4.6.
EPSS: top 76%Astro: Reflected XSS via unescaped slot name
Fixed in 6.3.3.
EPSS: top 83%Astro vulnerable to reflected XSS via the server islands feature
Fixed in 5.15.8.
EPSS: top 60%Astro's bypass of image proxy domain validation leads to SSRF and potential XSS
Fixed in 5.13.10.
EPSS: top 73%
Maintenance and supply chain
deps.dev has no OpenSSF Scorecard for this repository.
Docs and release notes
Check Astro in your own stack
This page checks Astro in general. Your repo pins specific versions: the free dependency check reads your manifests and lists what to fix first. Prism Agent runs the same live checks on your whole stack and turns them into a plan your coding agent can build.