Astro: Server island encrypted parameters vulnerable to cross-component replay

Description

Astro versions prior to 6.1.10 used AES-GCM encryption to protect the confidentiality and integrity of server island props and slots parameters, but did not bind the ciphertext to its intended component or parameter type. An attacker could replay one component’s encrypted props (p) value as another component’s slots (s) value, or vice versa.

Recommendation

Update the astro package to the latest compatible version. Followings are version details:

• Affected version(s): < 6.1.10
• Patched version(s): 6.1.10

References

• GHSA-xr5h-phrj-8vxv
• CVE-2026-45028
• CWE-323
• CWE-79
• CAPEC-310
• OWASP 2021-A2
• OWASP 2021-A3
• OWASP 2021-A6

Related Issues

• Parse Server vulnerable to stored cross-site scripting (XSS) via SVG file upload - CVE-2026-30948
• Astro development server error page is vulnerable to reflected Cross-site Scripting - CVE-2025-64745
• webpack-dev-server vulnerable to cross-origin source code exposure on non-HTTPS origins - CVE-2026-6402
• Materialize-css vulnerable to Cross-site Scripting in autocomplete component - materialize-css - CVE-2019-11003

You might also like:

Exploiting Server Version Disclosure

How to Secure your NodeJs Express Javascript Application - part 2

10 Secure Coding Best Practices to Follow in Every Project

Tags:

npm

astro