How should we interpret CVSS severity scores?

CVSS estimates technical severity, but it does not automatically equal business risk. Prioritize using context like internet exposure, asset criticality, known exploitation, and whether compensating controls exist. A Medium CVSS on an exposed production system can be more urgent than a Critical on an isolated non-production host.

Vulnerability Database

Q: What is a Vulnerability (CVE) and why does it matter?

A security vulnerability is a weakness in software, hardware, or configuration that can be exploited to compromise confidentiality, integrity, or availability. Many vulnerabilities are tracked as CVEs (Common Vulnerabilities and Exposures), which provide a standardized identifier so teams can coordinate patching, mitigation, and risk assessment across tools and vendors.

Q: What's the difference between a vulnerability, an exploit, and a zero-day?

A vulnerability is the underlying weakness. An exploit is the method or code used to take advantage of it. A zero-day is a vulnerability that is unknown to the vendor or has no publicly available fix when attackers begin using it. Risk increases sharply when exploitation becomes reliable or widespread.

Q: Why do vulnerabilities keep reappearing in our environment?

Recurring findings usually come from incomplete asset discovery, inconsistent patch management, inherited images, and configuration drift. In modern environments, you also need to watch the software supply chain: dependencies, containers, build pipelines, and third-party services can reintroduce the same weakness even after you patch a single host.

Q: How do we prioritize remediation without burning out the team?

Use a repeatable triage model: focus first on externally exposed assets, high-value systems (identity, VPN, email, production), vulnerabilities with known exploits, and issues that enable remote code execution or privilege escalation. Then enforce patch SLAs and track progress so remediation is steady, not reactive.

Q: How can SynScan help reduce vulnerability risk over time?

SynScan combines attack surface monitoring and continuous security auditing to keep your inventory current, flag high-impact vulnerabilities early, and help you turn raw findings into a practical remediation plan.

362,557

Total vulnerabilities in the database

Astro: Unauthenticated path override in the @astrojs/vercel ISR function — @astrojs / vercel

Unintended Proxy or Intermediary ('Confused Deputy')

Summary

When ISR is enabled, the serverless entrypoint lets an unauthenticated request decide which route the origin renders. The internal _isr function reads the x_astro_path query parameter and rewrites the request path to it without any authentication. Edge level access controls only ever see the /_isr path, so they do not apply to the route that actually gets rendered. This is the same confused deputy problem as CVE-2026-33768, reachable again through the ISR path.

Impact

This affects apps that use @astrojs/vercel with isr: true and protect routes at the edge. Two common setups are affected:

Path rules or firewall deny rules configured on Vercel (for example blocking /admin).
Split deployments (edgeMiddleware: true) where authorization lives in Astro middleware, since that middleware runs at the edge and not in the origin.

An attacker reads any GET rendered route by requesting /_isr?x_astro_path=/the/protected/path. No credentials are required. The protected content is produced by a fresh origin render, so the attack does not depend on the response being cached first.

Details

packages/integrations/vercel/src/serverless/entrypoint.ts picks the real path like this:

if (hasValidMiddlewareSecret) {
  realPath = request.headers.get(ASTRO_PATH_HEADER);       // secret checked
} else if (request.headers.get(&#039;x-vercel-isr&#039;) === &#039;1&#039;) {
  realPath = url.searchParams.get(ASTRO_PATH_PARAM);        // no secret checked
}

The header path is gated by the per build secret and is fine. The ISR branch is not. Two facts make it reachable by anyone:

The _isr function is publicly addressable.
Vercel sets x-vercel-isr: 1 on requests to it, including direct external requests, so the attacker does not even need to send that header.

So GET /_isr?x_astro_path=/admin sets the internal path to /admin and renders it. The edge saw only /_isr, which is allowed, so any path based rule on /admin never fires. In split deployments the edge middleware also runs against /_isr, and the origin does not run middleware at all, so middleware based auth is skipped as well.

How this regressed

CVE-2026-33768 was fixed in 10.0.2 by commit 335a204161 (PR #15959), which required the secret for every path override and removed the query parameter source. Commit aa266364fe (PR #16079, "Fix ISR path rewrite to prevent 404") brought the query parameter back, guarded only by the x-vercel-isr header. That header is not a security boundary, so the fix was effectively undone for ISR routes starting in 10.0.3.

Worth noting the contrast: the original report treated Edge Middleware as the mitigation and scoped the issue to deployments without it. Here, for split deployments, Edge Middleware is bypassed too, since the attacker reaches /_isr directly and the middleware only sees /_isr while the origin runs none.

Proof of concept

Create an Astro app with output: 'server' and adapter vercel({ isr: true }).
Add a page at /admin that returns sensitive content.
Deny /admin at the edge, for example a Vercel path rule that returns 403, or a middleware auth check in a split (edgeMiddleware: true) build.
Request /admin. It is blocked (403).
Request /_isr?x_astro_path=/admin. It returns 200 with the admin content. The response header X-Vercel-Cache: MISS confirms it was rendered fresh, not served from an existing cache entry.

What is not affected

Classic (non split) middleware. It runs inside the origin against the rewritten path, so it still applies to the target route.
State changing requests. Vercel serves ISR functions for GET only, and returns 403 for POST, PUT and DELETE, so the method preserving variant of CVE-2026-33768 does not reproduce here. Impact is limited to reading (confidentiality).
Whole deployment protection (Vercel SSO or password), which also covers /_isr.

Severity

Unauthenticated read of any GET rendered route that is protected only at the edge. No integrity or availability impact because the vector is GET only.

Suggested fix

One option would be to require the secret again for path overrides, the way PR #15959 did, so the ISR branch stops trusting the client supplied x_astro_path. The 404 that PR #16079 was fixing would then need another approach that does not rely on client input.

Published: Jul 20, 2026
Updated: Jul 21, 2026
GHSA: GHSA-x27w-589x-frm2
Severity: Medium
Exploit:
CISA KEV:

No technical information available.

CWEs:

Affected Software
References

Software	From	Fixed in
@astrojs / vercel	10.0.3	11.0.3

Deep Security Visibility Without the Complexity

SynScan provides clear, real-time security insights so you can monitor your attack surface, spot risks early, and act fast—without extra complexity.

No setup fees
5-min deployment
Cancel anytime

Book a Demo

Frequently Asked Questions

What is a Vulnerability (CVE) and why does it matter?

A security vulnerability is a weakness in software, hardware, or configuration that can be exploited to compromise confidentiality, integrity, or availability. Many vulnerabilities are tracked as CVEs (Common Vulnerabilities and Exposures), which provide a standardized identifier so teams can coordinate patching, mitigation, and risk assessment across tools and vendors.

CVSS (Common Vulnerability Scoring System) estimates technical severity, but it doesn't automatically equal business risk. Prioritize using context like internet exposure, affected asset criticality, known exploitation (proof-of-concept or in-the-wild), and whether compensating controls exist. A "Medium" CVSS on an exposed, production system can be more urgent than a "Critical" on an isolated, non-production host.

A vulnerability is the underlying weakness. An exploit is the method or code used to take advantage of it. A zero-day is a vulnerability that is unknown to the vendor or has no publicly available fix when attackers begin using it. In practice, risk increases sharply when exploitation becomes reliable or widespread.

Recurring findings usually come from incomplete Asset Discovery, inconsistent patch management, inherited images, and configuration drift. In modern environments, you also need to watch the software supply chain: dependencies, containers, build pipelines, and third-party services can reintroduce the same weakness even after you patch a single host. Unknown or unmanaged assets (often called Shadow IT) are a common reason the same issues resurface.

Use a simple, repeatable triage model: focus first on externally exposed assets, high-value systems (identity, VPN, email, production), vulnerabilities with known exploits, and issues that enable remote code execution or privilege escalation. Then enforce patch SLAs and track progress using consistent metrics so remediation is steady, not reactive.

SynScan combines attack surface monitoring and continuous security auditing to keep your inventory current, flag high-impact vulnerabilities early, and help you turn raw findings into a practical remediation plan.