Is CVE-2026-114127 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-114127 being exploited in the wild.

How severe is CVE-2026-114127?

Medium severity, with a CVSS score of 4, published 21 October 2026.

Which products and versions are affected?

Astro 7.1.0 to 7.3.2; astro (npm) >= 7.1.0, <= 7.3.2, SEMVER:introduced=7.1.0,fixed=7.3.3.

Is there a fix for CVE-2026-114127?

Yes. astro (npm): upgrade to 7.3.3 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-114127 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-114127?

Check whether you run Astro or astro (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-114127: Astro CSS injection in View Transition animation values

Q: Is there a fix for CVE-2026-114127?

Yes. astro (npm): upgrade to 7.3.3 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-114127 attacked?

It is attacked over the network, in a software library.

Q: Am I affected by CVE-2026-114127?

Check whether you run Astro or astro (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-114127 · Severity: medium · CVSS 4 · Published 2026-10-21

Astro is a web framework used to build content-driven websites. A vulnerability in its View Transition CSS generator allows attackers to inject malicious CSS rules by providing crafted values for animation properties like duration, delay, and easing. An attacker can manipulate the rendered page to hide content, reveal sensitive information, or deceive users about the interface without directly executing JavaScript.

Technologies: Astro, astro (npm). Vendors: Astro, npm.

Quick answers

Is CVE-2026-114127 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-114127 being exploited in the wild.
How severe is CVE-2026-114127?: Medium severity, with a CVSS score of 4, published 21 October 2026.
Which products and versions are affected?: Astro 7.1.0 to 7.3.2; astro (npm) >= 7.1.0, <= 7.3.2, SEMVER:introduced=7.1.0,fixed=7.3.3.
Is there a fix for CVE-2026-114127?: Yes. astro (npm): upgrade to 7.3.3 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-114127 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-114127?: Check whether you run Astro or astro (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

astro (npm): upgrade to 7.3.3 or later
```
npm install astro@7.3.3
```

Technical details

The server-side View Transition CSS generator fails to properly escape or validate animation property values (duration, delay, easing, direction, fillMode, animation names), allowing CSS declaration delimiters to be injected. This is a CSS injection vulnerability affecting versions 7.1.0 through 7.3.2. An attacker with control over these properties can inject arbitrary CSS rules, though the implementation still escapes literal less-than characters preventing HTML/JavaScript injection via style element breakout.

Affected products

Astro Astro 7.1.0 to 7.3.2

Identifiers

CVE-2026-114127
GHSA-mpr7-6m5w-76rw

Timeline

2026-10-21: disclosed
2026-09-15: patched: Fix merged to main branch via PR #17970

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.