Is CVE-2026-73424 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-73424 being exploited in the wild.

How severe is CVE-2026-73424?

Medium severity, with a CVSS score of 6.5, published 17 August 2026.

Which products and versions are affected?

Astro Vercel adapter 10.0.3 to 11.0.2; @astrojs/vercel (npm) SEMVER:introduced=10.0.3,fixed=11.0.3.

Is there a fix for CVE-2026-73424?

Yes. @astrojs/vercel (npm): upgrade to 11.0.3 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-73424 attacked?

It is attacked over the network.

Am I affected by CVE-2026-73424?

Check whether you run Astro Vercel adapter or @astrojs/vercel (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-73424: Astro Vercel ISR unauthenticated path override

CVE-2026-73424 · Severity: medium · CVSS 6.5 · Published 2026-08-17

Astro's Vercel adapter with ISR (Incremental Static Regeneration) enabled allows unauthenticated users to bypass edge-level access controls by specifying arbitrary page paths via a query parameter. An attacker can read any protected page or API response that is secured only at the edge (e.g., through Vercel firewall rules or edge middleware), compromising the confidentiality of sensitive content and potentially exposing administrative interfaces.

Vendors: Astro, npm.

Quick answers

Is CVE-2026-73424 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-73424 being exploited in the wild.
How severe is CVE-2026-73424?: Medium severity, with a CVSS score of 6.5, published 17 August 2026.
Which products and versions are affected?: Astro Vercel adapter 10.0.3 to 11.0.2; @astrojs/vercel (npm) SEMVER:introduced=10.0.3,fixed=11.0.3.
Is there a fix for CVE-2026-73424?: Yes. @astrojs/vercel (npm): upgrade to 11.0.3 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-73424 attacked?: It is attacked over the network.
Am I affected by CVE-2026-73424?: Check whether you run Astro Vercel adapter or @astrojs/vercel (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

@astrojs/vercel (npm): upgrade to 11.0.3 or later
```
npm install @astrojs/vercel@11.0.3
```

Technical details

The @astrojs/vercel serverless entrypoint reads the x_astro_path query parameter (via ISR) and the x-astro-path header to override the internal request path without authentication. While the header path is protected by a per-build middleware secret, the ISR query parameter path is guarded only by the x-vercel-isr header, which Vercel sets on all requests including direct external ones—meaning any caller can supply x_astro_path. This creates a confused deputy problem: edge firewalls and path-based rules see only the /_isr path (allowed), while the origin renders the attacker-controlled path. In split deployments with edge middleware, the middleware runs only against /_isr and never reaches the origin, so authorization is completely bypassed. The vulnerability is reachable via GET requests only (POST/PUT/DELETE are blocked by Vercel's ISR layer), limiting impact to confidentiality. The issue was introduced in version 10.0.3 when a fix for a prior path override vulnerability was weakened. A patch is available in @astrojs/vercel 11.0.3 and later.

Affected products

Astro Vercel adapter 10.0.3 to 11.0.2

Identifiers

CVE-2026-73424
GHSA-x27w-589x-frm2

Timeline

2026-07-20: disclosed: GHSA-x27w-589x-frm2 published
2026-07-20: patched: @astrojs/vercel 11.0.3 released with fix

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.