{"cve":"CVE-2026-54299","nvd":{"published":"2026-06-22T19:17:21.260","modified":"2026-10-25T23:10:00.167","status":"Analyzed","description":"Astro is a web framework. Prior to 6.4.6, Astro SSR apps with prerendered error pages (/404 or /500 using export const prerender = true) fetch those pages over HTTP at runtime when an error occurs. The URL for this fetch is derived from request.url, which in turn gets its origin from the incoming Host header. When the Host header is not validated against allowedDomains, an attacker can point the fetch at an arbitrary host and read the response. This vulnerability is fixed in 6.4.6.","cvss_v4":null,"cvss_v3":{"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","score":7.5},"cwes":["CWE-20","CWE-918"],"references":["https://github.com/withastro/astro/security/advisories/GHSA-2pvr-wf23-7pc7"],"products":["astro:astro"],"source":"nvd","synced_at":"2026-10-25T23:44:33.281319194+00:00"},"epss":{"cve":"CVE-2026-54299","score":0.00333,"percentile":0.26241,"date":"2026-10-25"},"kev":null,"osv":[{"id":"GHSA-2pvr-wf23-7pc7","url":"https://osv.dev/vulnerability/GHSA-2pvr-wf23-7pc7","summary":"Astro: Host header SSRF in prerendered error page fetch","modified":"2026-08-12T20:45:07.787678102Z","packages":[{"ecosystem":"npm","name":"astro","purl":"pkg:npm/astro","ranges":["<6.4.6"],"fixed":["6.4.6"]}]}],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}