Sign in Sign up
JA · EN · FR
SecPulse
Categories
CVE-2026-73424 medium CVSS 6.5

Vulnerability in @astrojs/vercel (CVE-2026-73424)

Summary

Vulnerability in @astrojs/vercel (CVE-2026-73424). Risk of unauthorized operations or information disclosure. Exploitable via GET /_isr. Mitigation: upgrade to 10.0.2 or later.

Original description

The description as published by the source.

Summary

When ISR is enabled, the serverless entrypoint lets an unauthenticated request
decide which route the origin renders. The internal _isr function reads the
x_astro_path query parameter and rewrites the request path to it without any
authentication. Edge level access controls only ever see the /_isr path, so
they do not apply to the route that actually gets rendered. This is the same
confused deputy problem as CVE-2026-33768, reachable again through the ISR path.

Impact

This affects apps that use @astrojs/vercel with isr: true and protect routes
at the edge. Two common setups are affected:

  1. Path rules or firewall deny rules configured on Vercel (for example blocking
    /admin).
  2. Split deployments (edgeMiddleware: true) where authorization lives in Astro
    middleware, since that middleware runs at the edge and not in the origin.

An attacker reads any GET rendered route by requesting
/_isr?x_astro_path=/the/protected/path. No credentials are required. The
protected content is produced by a fresh origin render, so the attack does not
depend on the response being cached first.

Details

packages/integrations/vercel/src/serverless/entrypoint.ts picks the real path
like this:

if (hasValidMiddlewareSecret) {
  realPath = request.headers.get(ASTRO_PATH_HEADER);       // secret checked
} else if (request.headers.get('x-vercel-isr') === '1') {
  realPath = url.searchParams.get(ASTRO_PATH_PARAM);        // no secret checked
}

The heade…

Source: GitHub Security Advisories (Global) NVD GitHub Advisory

Auto-generated summary

Assembled by SecPulse from the source data (CVSS, CWE, affected versions) using templates — no AI involved. Check the original description and references below for exact details.

A vulnerability tracked as CVE-2026-73424 has been found in @astrojs/vercel.
Attackers can target a specific entry point like GET /_isr over the network to misuse the product.
Risk of unauthorized operations or information disclosure. CVSS score: 6.5/10.
What to do: upgrade @astrojs/vercel to 10.0.2 or later.
If unsure, ask your IT team or search "@astrojs/vercel CVE-2026-73424" on the vendor's site.

CVE-2026-73424 (@astrojs/vercel) — CWE-441 / CVSS v3 6.5
Attack vector: remote (network-reachable) / unauthenticated / no user interaction
Attack surface: GET /_isr / _isr / x_astro_path
Patched: 10.0.2 — apply immediately
Plan: 1) Audit SBOM/dependencies, 2) Stage→prod upgrade, 3) Add WAF/proxy monitoring on affected endpoints, 4) Hunt IOCs in logs.
Refs: see the GHSA / vendor advisory / patched release linked on this page.

❓ What is the problem

A vulnerability (CWE-441) exists in @astrojs/vercel. Attackers reach the vulnerable code path via GET /_isr without authentication.

📍 Affected scope

Check the vendor advisory for the affected versions of @astrojs/vercel. Attack surface: GET /_isr / _isr / x_astro_path.

🔥 Severity

Severity: Medium (CVSS 6.5/10). Risk of unauthorized operations or information disclosure.

🔧 How to fix

Update to 10.0.2.

🛡️ Workaround

Until the patch is applied: disable the affected feature, apply WAF rules, or restrict access via network ACLs.

🔍 Detection

Search webserver/proxy logs for unusual GET /_isr requests with malformed payloads or SQL meta-characters. Run grep -r '@astrojs/vercel' . against your dependency files (package-lock.json, requirements.txt, go.sum) to find affected services.

Response actions

Concrete steps and command examples for SOC/SRE teams to execute in order

  1. 1
    Identify exposure identify 
    grep -r '@astrojs/vercel' . | grep -v node_modules

    リポジトリと本番環境の依存ファイル (package-lock.json / requirements.txt / go.sum / Gemfile.lock 等) で @astrojs/vercel を grep し、稼働しているサービス・バージョンを把握する。

  2. 2
    Hunt for indicators of compromise detect 
    grep 'GET /_isr' /var/log/nginx/access.log | grep -E '(unusual_payload|sqli_pattern)'

    アクセスログで GET /_isr への異常なリクエスト (不正な認証ヘッダ・SQLメタ文字)を過去 30〜90日分捜索。WAF/SIEM があれば該当パスのアラート発火履歴を確認。

  3. 3
    Apply patch patch 
    Upgrade @astrojs/vercel to 10.0.2

    ステージング環境で 10.0.2 に上げて回帰テスト → 本番反映。回帰テストはアプリの主要ハッピーパスと、Step 2 で見つけた異常検知の続報チェックを含めること。

  4. 4
    Post-deployment verification verify 
    Replay attack against GET /_isr on staging to confirm patch closes the vector

    パッチ適用後、ステージングで PoC または同等の悪用パターンを再現して脆弱性が閉じたことを確認。本番では Step 2 と同じログクエリでアラート再発が無いか継続監視。

Affected packages

npm @astrojs/vercel
[{"type":"SEMVER","events":[{"introduced":"10.0.3"},{"fixed":"11.0.3"}]}]

References

We use cookies for analytics and ad measurement. This setting applies to all Game co., Ltd. sites. Details