Security context
What an agent needs to avoid regressing past fixes and find the next vuln in this repo.
withastro/astro
main @ 675d11d
109
Fixes
28
CVEs
CRITICAL
Peak severity
23.5%
Coverage
Highlights
Auth Bypass: 21 prior fixes. Scrutinize any change in this area.
packages/astro/src/core/render-context.ts: most-fixed (5 issues). Treat as high-risk during review.
50 high-severity fixes in this history; regressions here are high-impact.
Recurring patterns
The bug types that recur here, drawn from past fixes, not open vulnerabilities.
Auth Bypass: Inconsistent URL-decoding and path normalization allowed double or multi-level URL-encoded paths to bypass routing-based middleware authorization checks before being executed. Developers must enforce iterative, robust URL decoding and consistent canonicalization.
SSRF: The image optimization endpoint historically allowed remote pattern and origin bypasses via protocol-relative URLs, unanchored domain regexes, and backslash bypasses. To mitigate this, developers must tightly validate remote redirect chains and use strict URL/protocol validation before dispatching requests.
Prototype Pollution: Server Island endpoints used unsafe 'in' operator checks on client-provided data, allowing prototype pollution and arbitrary payload lookups. The application was hardened to enforce strict 'own-property' validation (e.g., via Object.hasOwn) and null-prototype fallbacks.