Astro: Server island encrypted parameters vulnerable to cross-component replay

Description

Astro versions prior to 6.1.10 used AES-GCM encryption to protect the confidentiality and integrity of server island props and slots parameters, but did not bind the ciphertext to its intended component or parameter type. An attacker could replay one component’s encrypted props (p) value as another component’s slots (s) value, or vice versa.

Recommendation

Update the astro package to the latest compatible version. Followings are version details:

• Affected version(s): < 6.1.10
• Patched version(s): 6.1.10

References

• GHSA-xr5h-phrj-8vxv
• CVE-2026-45028
• CWE-323
• CWE-79
• CAPEC-310
• OWASP 2021-A2
• OWASP 2021-A3
• OWASP 2021-A6

Related Issues

• Astro development server error page is vulnerable to reflected Cross-site Scripting - CVE-2025-64745
• Parse Server vulnerable to stored cross-site scripting (XSS) via SVG file upload - CVE-2026-30948
• webpack-dev-server vulnerable to cross-origin source code exposure on non-HTTPS origins - CVE-2026-6402
• Parse Server vulnerable to SQL Injection via dot-notation sub-key name in `Increment` operation on PostgreSQL - CVE-2026-31871

You might also like:

Exploiting Server Version Disclosure

How to Secure your NodeJs Express Javascript Application - part 2

10 Secure Coding Best Practices to Follow in Every Project

Tags:

npm

astro