astro

Follow this package

Get the evidence behind this dependency. Browse imported advisories below, or check an exact version against OSV now. View source coverage.

Behind the package

View on npm

Explore what the publisher declares for the latest npm release. These details are not a safety score; listed attestations have not been independently verified here.

Astro is a modern site builder with web best practices, performance, and DX front-of-mind.

Latest release7.4.12

Declared licenseMIT

Listed maintainersfredkschott, matthewp

Runtime dependencies52

Install-time scriptsNone declared

Integrity metadataRecorded by registry

Attestation metadataRecorded, not verified here

Registry deprecationNot marked deprecated

Direct dependencies of 7.4.12

mri^1.2.0
zod^4.6.7
diff^9.0.0
dset^3.1.4
obug^3.0.0
svgo^4.1.0
vite^8.3.6
shiki^4.6.0
cookie^2.0.2
mrmime^2.0.1
tinyps^0.5.1
verkit^0.5.0
vitefu^1.1.3
ci-info^4.4.0
devalue^6.0.3
flattie^1.1.1
fontace~0.4.1
p-limit^7.3.3
p-queue^10.0.0
unifont^1.0.3
magicast^0.5.5
rolldown~1.2.16
tinyclip^1.0.3
tinyexec^1.3.1
piccolore^0.1.3
picomatch^4.0.7
smol-toml^1.9.1
ultrahtml^1.7.0
unstorage^1.17.6
aria-query^5.3.2
tinyglobby^0.2.17
am-i-vibing^0.5.0
neotraverse^1.0.1
xxhash-wasm^1.1.0
get-tsconfig5.0.0-beta.6
html-escaper3.0.3
jsonc-parser^3.3.1
magic-string^1.4.5
@clack/prompts^1.8.1
axobject-query^4.1.0
github-slugger^2.0.0
es-module-lexer^3.0.4
@astrojs/runtime^0.1.1
@oslojs/encoding^1.1.0
@astrojs/telemetry^3.4.2
@capsizecss/unpack^4.0.1
@astrojs/compiler-rs^0.5.2
http-cache-semantics^4.3.0
package-manager-detector^1.9.0
@astrojs/internal-helpers^0.13.2
@astrojs/markdown-satteri^0.4.10
@astrojs/vite-plugin-astro^0.1.3

Fetched 15/11/2026, 02:08:56 UTC · Original registry metadata

Release history

Explore up to 40 recent releases. Pick a version for an OSV check; registry metadata alone does not tell you whether a release has known vulnerabilities.

Check the version you ship.

Get a fresh OSV lookup for an exact release. We send the package name and version to OSV without storing a report.

Advisories & recorded fixes

medium6.3

CVE-2026-126364Some package fixes recorded

Astro: Image endpoint in @astrojs/node can read files from a case-variant sibling of the output directory on case-sensitive filesystems

The /_image endpoint used by the @astrojs/node adapter checks that a requested local image is inside the build output directory before reading it from disk. That check compared paths case-insensitively. On case-sensitive filesystems (such as Linux), a directory whose path differs from the output directory only by letter case is a different directory, but it passed the check.

Recorded fixes — astro: 7.4.7. Check your release branch.

Exploitation not established

npm / @astrojs/node npm / astro

12 Nov 2026

astro npm

Affected range	Recorded fix
From 5.14.3 before 7.4.7Semantic versions	7.4.7

Version evidence: OSV · GHSA-r3h5-4585-7x3w

View original version evidence

{
  "ranges": [
    {
      "events": [
        {
          "introduced": "5.14.3"
        },
        {
          "fixed": "7.4.7"
        }
      ],
      "type": "SEMVER"
    }
  ],
  "versions": []
}

low2.3

CVE-2026-126361Package fixes recorded

Astro: XSS via attribute injection in dynamic tag names

When a dynamic tag (const Tag = ...; <Tag />) resolves to a string, Astro renders it as a raw HTML element name. The name was filtered to remove characters that could inject attributes, but the filter did not handle /. Because HTML parsers treat / inside a tag as an attribute separator, a tag name such as img/src/onerror=alert(1) was rendered as an <img> element with an onerror attribute. The JSX renderer used for MDX did not filter string tag names at all.

Recorded fixes — astro: 7.4.5. Check your release branch.

Exploitation not established

npm / astro

12 Nov 2026

astro npm

Affected range	Recorded fix
Earlier releases before 7.4.5Semantic versions	7.4.5

Version evidence: OSV · GHSA-mh32-jxcr-mh9f

View original version evidence

{
  "ranges": [
    {
      "events": [
        {
          "introduced": "0"
        },
        {
          "fixed": "7.4.5"
        }
      ],
      "type": "SEMVER"
    }
  ],
  "versions": []
}