# CVE-2024-56159: Astro server source code exposure via enabled sourcemaps

Source: https://junglewise.ai/threats/cve-2024-56159-astro-server-source-code-exposure-via-enabled-sourcemaps  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2024-12-19. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2024-56159 · Severity: medium · CVSS 4 · Published 2024-12-19

Astro is a web framework that generates static or dynamically-rendered websites. When developers enable sourcemaps (which map compiled code back to original source for debugging), a bug in Astro's build process inadvertently exposes server-side source code to the public internet without authentication. An attacker can download these sourcemap files using simple HTTP requests and reconstruct the full server-side source code, potentially revealing business logic and enabling discovery of additional security vulnerabilities.

Technologies: [astro (npm)](https://junglewise.ai/threats/technologies/astro). Vendors: [npm](https://junglewise.ai/threats/vendors/npm).

## Quick answers

**Is CVE-2024-56159 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2024-56159 being exploited in the wild.

**How severe is CVE-2024-56159?** Medium severity, with a CVSS score of 4, published 19 December 2024.

**Which products and versions are affected?** astro (npm) SEMVER:introduced=5.0.0-alpha.0,fixed=5.0.8.

**Is there a fix for CVE-2024-56159?** Yes. astro (npm): upgrade to 5.0.8 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2024-56159 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2024-56159?** Check whether you run astro (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- astro (npm): upgrade to 5.0.8 or later

  ```sh
  npm install astro@5.0.8
  ```


## Technical details

This is a sensitive information disclosure vulnerability (CWE-219) affecting Astro's static build process. During the build phase, sourcemap files for server-side code (`.mjs.map` files) are copied to the same publicly-accessible folder (`dist/client`) as client-side assets such as CSS and fonts. For projects using file-system routing (pages in `src/pages`), these sourcemap files are predictably named (e.g., `dist/client/pages/index.astro.mjs.map`), allowing unauthenticated attackers to discover and download them via direct HTTP GET requests. The sourcemaps can be reconstructed to reveal full server source code using standard source-map visualization tools. Attack vector is network-based, requires no authentication or user interaction, and applies to: (1) Astro 5 server-output (SSR) projects v5.0.3–v5.0.6 with sourcemaps enabled, and (2) Astro 4 and 5 static-output (SSG) projects v4.16.17 and earlier (v5.0.7 and earlier) with sourcemaps enabled. Fixes released in astro@5.0.7 (SSR) and astro@5.0.8 (SSG) / astro@4.16.18 (SSG backport).

## Affected products

- Astro Astro 5.0.3 through 5.0.6 (SSR); 4.16.17 and earlier, 5.0.7 and earlier (SSG)

## Identifiers

- CVE-2024-56159
- GHSA-49w6-73cw-chjr

## Timeline

- 2024-12-19: disclosed
- 2024-12-16: patched: Fix released in astro@5.0.8 (SSG) and astro@4.16.18 (SSG backport); astro@5.0.7 (SSR)

## References

- [https://github.com/withastro/astro/security/advisories/GHSA-49w6-73cw-chjr](https://github.com/withastro/astro/security/advisories/GHSA-49w6-73cw-chjr)
- [https://github.com/withastro/astro/issues/12703](https://github.com/withastro/astro/issues/12703)
- [https://github.com/withastro/astro/commit/039d022b1bbaacf9ea83071d27affc5318e0e515](https://github.com/withastro/astro/commit/039d022b1bbaacf9ea83071d27affc5318e0e515)
- [https://github.com/withastro/astro/commit/c879f501ff01b1a3c577de776a1f7100d78f8dd5](https://github.com/withastro/astro/commit/c879f501ff01b1a3c577de776a1f7100d78f8dd5)
- [https://github.com/getsentry/sentry-javascript/blob/develop/packages/astro/src/integration/index.ts](https://github.com/getsentry/sentry-javascript/blob/develop/packages/astro/src/integration/index.ts)
- [https://github.com/withastro/astro](https://github.com/withastro/astro)

## Related threats

- [Astro HTML injection in script and style element rendering](https://junglewise.ai/threats/cve-2026-114128-astro-is-a-web-framework-for-content-driven-websites-prior-to-7)
- [Astro CSS injection in View Transition animation values](https://junglewise.ai/threats/cve-2026-114127-astro-is-a-web-framework-for-content-driven-websites-from-7-1-0)
- [Astro remote code execution via AVIF image processing](https://junglewise.ai/threats/astro-remote-code-execution-via-avif-image-processing-6b99ffe8)
- [Astro authorization bypass in base path stripping](https://junglewise.ai/threats/cve-2026-84376-astro-authorization-bypass-in-base-path-stripping)
- [Astro composable astro/hono pipeline CSRF via origin check bypass](https://junglewise.ai/threats/cve-2026-73423-astro-composable-astro-hono-pipeline-csrf-via-origin-check-bypass)