{ "@id": "urn:uuid:eb154b78-0ce1-4bda-8714-36f4280bf35a", "role": "Document Creator", "author": "https://tuxcare.com", "version": 16, "@context": "https://openvex.dev/ns/v0.2.0", "timestamp": "2026-11-13T18:51:49.799753+00:00", "statements": [ { "status": "affected", "products": [ { "@id": "pkg:npm/astro@2.10.15-tuxcare.4", "identifiers": { "purl": "pkg:npm/astro@2.10.15-tuxcare.4" } } ], "timestamp": "2026-10-29T07:04:28.598882+00:00", "status_notes": "Vulnerability CVE-2024-47885 affects version 2.10.15-tuxcare.4 of astro.", "vulnerability": { "name": "CVE-2024-47885" }, "action_statement": "Vulnerability CVE-2024-47885 affects version 2.10.15-tuxcare.4 of astro." }, { "status": "fixed", "products": [ { "@id": "pkg:npm/astro@2.10.15-tuxcare.4", "identifiers": { "purl": "pkg:npm/astro@2.10.15-tuxcare.4" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-56140 is fixed in version 2.10.15-tuxcare.4 of astro.", "vulnerability": { "name": "CVE-2024-56140" } }, { "status": "fixed", "products": [ { "@id": "pkg:npm/astro@2.10.15-tuxcare.4", "identifiers": { "purl": "pkg:npm/astro@2.10.15-tuxcare.4" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-56159 is fixed in version 2.10.15-tuxcare.4 of astro.", "vulnerability": { "name": "CVE-2024-56159" } }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/astro@2.10.15-tuxcare.4", "identifiers": { "purl": "pkg:npm/astro@2.10.15-tuxcare.4" } } ], "timestamp": "2026-11-03T13:52:02.256694+00:00", "status_notes": "Vulnerability CVE-2025-54793 does not affect version 2.10.15-tuxcare.4 of astro. not_affected \u2014 Astro version 2.10.15 does not contain the vulnerable automatic SSR trailing slash redirection feature described in CVE-2025-54793. The CVE affects versions >=5.2.0, while this target is version 2.10.15\u2014substantially older. The vulnerable code pattern (INTERNAL_PREFIXES constant and isInternalPath function that the patch modifies) does not exist in this version. The automatic trailing slash red...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-54793" }, "impact_statement": "not_affected \u2014 Astro version 2.10.15 does not contain the vulnerable automatic SSR trailing slash redirection feature described in CVE-2025-54793. The CVE affects versions >=5.2.0, while this target is version 2.10.15\u2014substantially older. The vulnerable code pattern (INTERNAL_PREFIXES constant and isInternalPath function that the patch modifies) does not exist in this version. The automatic trailing slash red..." }, { "status": "affected", "products": [ { "@id": "pkg:npm/astro@2.10.15-tuxcare.4", "identifiers": { "purl": "pkg:npm/astro@2.10.15-tuxcare.4" } } ], "timestamp": "2026-10-25T00:32:50.821309+00:00", "status_notes": "Vulnerability CVE-2025-55303 affects version 2.10.15-tuxcare.4 of astro, and is fixed in 2.10.15-tuxcare.11.", "vulnerability": { "name": "CVE-2025-55303" }, "action_statement": "Vulnerability CVE-2025-55303 affects version 2.10.15-tuxcare.4 of astro, and is fixed in 2.10.15-tuxcare.11." }, { "status": "affected", "products": [ { "@id": "pkg:npm/astro@2.10.15-tuxcare.4", "identifiers": { "purl": "pkg:npm/astro@2.10.15-tuxcare.4" } } ], "timestamp": "2026-10-29T07:00:16.985656+00:00", "status_notes": "Vulnerability CVE-2025-59837 affects version 2.10.15-tuxcare.4 of astro.", "vulnerability": { "name": "CVE-2025-59837" }, "action_statement": "Vulnerability CVE-2025-59837 affects version 2.10.15-tuxcare.4 of astro." }, { "status": "fixed", "products": [ { "@id": "pkg:npm/astro@2.10.15-tuxcare.4", "identifiers": { "purl": "pkg:npm/astro@2.10.15-tuxcare.4" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-61925 is fixed in version 2.10.15-tuxcare.4 of astro.", "vulnerability": { "name": "CVE-2025-61925" } }, { "status": "affected", "products": [ { "@id": "pkg:npm/astro@2.10.15-tuxcare.4", "identifiers": { "purl": "pkg:npm/astro@2.10.15-tuxcare.4" } } ], "timestamp": "2026-10-29T07:04:28.598882+00:00", "status_notes": "Vulnerability CVE-2025-64525 affects version 2.10.15-tuxcare.4 of astro.", "vulnerability": { "name": "CVE-2025-64525" }, "action_statement": "Vulnerability CVE-2025-64525 affects version 2.10.15-tuxcare.4 of astro." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/astro@2.10.15-tuxcare.4", "identifiers": { "purl": "pkg:npm/astro@2.10.15-tuxcare.4" } } ], "timestamp": "2026-11-03T13:43:26.013143+00:00", "status_notes": "Vulnerability CVE-2025-64745 does not affect version 2.10.15-tuxcare.4 of astro. not_affected \u2014 Version 2.10.15 is not affected by CVE-2025-64745. The vulnerable function `trailingSlashMismatchTemplate` that renders unescaped pathname-derived values into HTML does not exist in this version. It was introduced in a later version (commit 536175528d, around v5.x). All error templates in 2.10.15 properly escape pathnames using `escape(pathname)` before HTML insertion, preventing the HTML injec...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-64745" }, "impact_statement": "not_affected \u2014 Version 2.10.15 is not affected by CVE-2025-64745. The vulnerable function `trailingSlashMismatchTemplate` that renders unescaped pathname-derived values into HTML does not exist in this version. It was introduced in a later version (commit 536175528d, around v5.x). All error templates in 2.10.15 properly escape pathnames using `escape(pathname)` before HTML insertion, preventing the HTML injec..." }, { "status": "fixed", "products": [ { "@id": "pkg:npm/astro@2.10.15-tuxcare.4", "identifiers": { "purl": "pkg:npm/astro@2.10.15-tuxcare.4" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-64757 is fixed in version 2.10.15-tuxcare.4 of astro.", "vulnerability": { "name": "CVE-2025-64757" } }, { "status": "fixed", "products": [ { "@id": "pkg:npm/astro@2.10.15-tuxcare.4", "identifiers": { "purl": "pkg:npm/astro@2.10.15-tuxcare.4" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-64764 is fixed in version 2.10.15-tuxcare.4 of astro.", "vulnerability": { "name": "CVE-2025-64764" } }, { "status": "fixed", "products": [ { "@id": "pkg:npm/astro@2.10.15-tuxcare.4", "identifiers": { "purl": "pkg:npm/astro@2.10.15-tuxcare.4" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-64765 is fixed in version 2.10.15-tuxcare.4 of astro.", "vulnerability": { "name": "CVE-2025-64765" } }, { "status": "fixed", "products": [ { "@id": "pkg:npm/astro@2.10.15-tuxcare.4", "identifiers": { "purl": "pkg:npm/astro@2.10.15-tuxcare.4" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-65019 is fixed in version 2.10.15-tuxcare.4 of astro.", "vulnerability": { "name": "CVE-2025-65019" } }, { "status": "fixed", "products": [ { "@id": "pkg:npm/astro@2.10.15-tuxcare.4", "identifiers": { "purl": "pkg:npm/astro@2.10.15-tuxcare.4" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-66202 is fixed in version 2.10.15-tuxcare.4 of astro.", "vulnerability": { "name": "CVE-2025-66202" } }, { "status": "affected", "products": [ { "@id": "pkg:npm/astro@2.10.15-tuxcare.4", "identifiers": { "purl": "pkg:npm/astro@2.10.15-tuxcare.4" } } ], "timestamp": "2026-10-29T07:08:50.234059+00:00", "status_notes": "Vulnerability CVE-2026-114127 affects version 2.10.15-tuxcare.4 of astro.", "vulnerability": { "name": "CVE-2026-114127" }, "action_statement": "Vulnerability CVE-2026-114127 affects version 2.10.15-tuxcare.4 of astro." }, { "status": "affected", "products": [ { "@id": "pkg:npm/astro@2.10.15-tuxcare.4", "identifiers": { "purl": "pkg:npm/astro@2.10.15-tuxcare.4" } } ], "timestamp": "2026-11-04T17:55:28.274838+00:00", "status_notes": "Vulnerability CVE-2026-114128 affects version 2.10.15-tuxcare.4 of astro, and is fixed in 2.10.15-tuxcare.12.", "vulnerability": { "name": "CVE-2026-114128" }, "action_statement": "Vulnerability CVE-2026-114128 affects version 2.10.15-tuxcare.4 of astro, and is fixed in 2.10.15-tuxcare.12." }, { "status": "affected", "products": [ { "@id": "pkg:npm/astro@2.10.15-tuxcare.4", "identifiers": { "purl": "pkg:npm/astro@2.10.15-tuxcare.4" } } ], "timestamp": "2026-11-13T18:50:32.418489+00:00", "status_notes": "Vulnerability CVE-2026-126361 affects version 2.10.15-tuxcare.4 of astro.", "vulnerability": { "name": "CVE-2026-126361" }, "action_statement": "Vulnerability CVE-2026-126361 affects version 2.10.15-tuxcare.4 of astro." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/astro@2.10.15-tuxcare.4", "identifiers": { "purl": "pkg:npm/astro@2.10.15-tuxcare.4" } } ], "timestamp": "2026-11-13T18:51:49.799753+00:00", "status_notes": "Vulnerability CVE-2026-126364 does not affect version 2.10.15-tuxcare.4 of astro. not_affected \u2014 Not affected (Type A2). In astro 2.10.15-tuxcare.12 the /_image endpoint never reads local files from disk. It builds a URL from the requested src and fetches it over HTTP, so the case-insensitive output-directory containment check described in the CVE does not exist here.", "justification": "vulnerable_code_not_in_execute_path", "vulnerability": { "name": "CVE-2026-126364" }, "impact_statement": "not_affected \u2014 Not affected (Type A2). In astro 2.10.15-tuxcare.12 the /_image endpoint never reads local files from disk. It builds a URL from the requested src and fetches it over HTTP, so the case-insensitive output-directory containment check described in the CVE does not exist here." }, { "status": "fixed", "products": [ { "@id": "pkg:npm/astro@2.10.15-tuxcare.4", "identifiers": { "purl": "pkg:npm/astro@2.10.15-tuxcare.4" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-33769 is fixed in version 2.10.15-tuxcare.4 of astro.", "vulnerability": { "name": "CVE-2026-33769" } }, { "status": "fixed", "products": [ { "@id": "pkg:npm/astro@2.10.15-tuxcare.4", "identifiers": { "purl": "pkg:npm/astro@2.10.15-tuxcare.4" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-41067 is fixed in version 2.10.15-tuxcare.4 of astro.", "vulnerability": { "name": "CVE-2026-41067" } }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/astro@2.10.15-tuxcare.4", "identifiers": { "purl": "pkg:npm/astro@2.10.15-tuxcare.4" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-45028 does not affect version 2.10.15-tuxcare.4 of astro. not_affected \u2014 Astro version 2.10.14 is not affected by CVE-2026-45028. The server islands feature with encrypted parameter handling does not exist in this version. The vulnerability requires server islands (introduced in later versions) to be present, specifically the encryption/decryption of props and slots parameters via AES-GCM. Version 2.10.14 predates this feature entirely. While the repository contains...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-45028" }, "impact_statement": "not_affected \u2014 Astro version 2.10.14 is not affected by CVE-2026-45028. The server islands feature with encrypted parameter handling does not exist in this version. The vulnerability requires server islands (introduced in later versions) to be present, specifically the encryption/decryption of props and slots parameters via AES-GCM. Version 2.10.14 predates this feature entirely. While the repository contains..." }, { "status": "fixed", "products": [ { "@id": "pkg:npm/astro@2.10.15-tuxcare.4", "identifiers": { "purl": "pkg:npm/astro@2.10.15-tuxcare.4" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-50146 is fixed in version 2.10.15-tuxcare.4 of astro.", "vulnerability": { "name": "CVE-2026-50146" } }, { "status": "fixed", "products": [ { "@id": "pkg:npm/astro@2.10.15-tuxcare.4", "identifiers": { "purl": "pkg:npm/astro@2.10.15-tuxcare.4" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-54298 is fixed in version 2.10.15-tuxcare.4 of astro.", "vulnerability": { "name": "CVE-2026-54298" } }, { "status": "fixed", "products": [ { "@id": "pkg:npm/astro@2.10.15-tuxcare.4", "identifiers": { "purl": "pkg:npm/astro@2.10.15-tuxcare.4" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-54299 is fixed in version 2.10.15-tuxcare.4 of astro.", "vulnerability": { "name": "CVE-2026-54299" } }, { "status": "affected", "products": [ { "@id": "pkg:npm/astro@2.10.15-tuxcare.4", "identifiers": { "purl": "pkg:npm/astro@2.10.15-tuxcare.4" } } ], "timestamp": "2026-10-29T07:05:56.841018+00:00", "status_notes": "Vulnerability CVE-2026-59727 affects version 2.10.15-tuxcare.4 of astro.", "vulnerability": { "name": "CVE-2026-59727" }, "action_statement": "Vulnerability CVE-2026-59727 affects version 2.10.15-tuxcare.4 of astro." }, { "status": "affected", "products": [ { "@id": "pkg:npm/astro@2.10.15-tuxcare.4", "identifiers": { "purl": "pkg:npm/astro@2.10.15-tuxcare.4" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-59729 affects version 2.10.15-tuxcare.4 of astro, and is fixed in 2.10.15-tuxcare.8.", "vulnerability": { "name": "CVE-2026-59729" }, "action_statement": "Vulnerability CVE-2026-59729 affects version 2.10.15-tuxcare.4 of astro, and is fixed in 2.10.15-tuxcare.8." }, { "status": "affected", "products": [ { "@id": "pkg:npm/astro@2.10.15-tuxcare.4", "identifiers": { "purl": "pkg:npm/astro@2.10.15-tuxcare.4" } } ], "timestamp": "2026-10-29T07:04:28.598882+00:00", "status_notes": "Vulnerability CVE-2026-59731 affects version 2.10.15-tuxcare.4 of astro.", "vulnerability": { "name": "CVE-2026-59731" }, "action_statement": "Vulnerability CVE-2026-59731 affects version 2.10.15-tuxcare.4 of astro." }, { "status": "affected", "products": [ { "@id": "pkg:npm/astro@2.10.15-tuxcare.4", "identifiers": { "purl": "pkg:npm/astro@2.10.15-tuxcare.4" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-73422 affects version 2.10.15-tuxcare.4 of astro, and is fixed in 2.10.15-tuxcare.8.", "vulnerability": { "name": "CVE-2026-73422" }, "action_statement": "Vulnerability CVE-2026-73422 affects version 2.10.15-tuxcare.4 of astro, and is fixed in 2.10.15-tuxcare.8." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/astro@2.10.15-tuxcare.4", "identifiers": { "purl": "pkg:npm/astro@2.10.15-tuxcare.4" } } ], "timestamp": "2026-11-03T13:58:58.947122+00:00", "status_notes": "Vulnerability CVE-2026-73423 does not affect version 2.10.15-tuxcare.4 of astro. not_affected \u2014 Version 2.10.15 is not affected by CVE-2026-73423. The vulnerability is specific to the composable `astro/hono` pipeline feature introduced in Astro 7.0.0, which allows users to manually assemble primitives (`middleware()`, `actions()`, `pages()`) in custom order. When these primitives are mounted out-of-order, the `security.checkOrigin` protection can be bypassed. Version 2.10.15 does not have...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-73423" }, "impact_statement": "not_affected \u2014 Version 2.10.15 is not affected by CVE-2026-73423. The vulnerability is specific to the composable `astro/hono` pipeline feature introduced in Astro 7.0.0, which allows users to manually assemble primitives (`middleware()`, `actions()`, `pages()`) in custom order. When these primitives are mounted out-of-order, the `security.checkOrigin` protection can be bypassed. Version 2.10.15 does not have..." }, { "status": "affected", "products": [ { "@id": "pkg:npm/astro@2.10.15-tuxcare.4", "identifiers": { "purl": "pkg:npm/astro@2.10.15-tuxcare.4" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-84376 affects version 2.10.15-tuxcare.4 of astro, and is fixed in 2.10.15-tuxcare.9.", "vulnerability": { "name": "CVE-2026-84376" }, "action_statement": "Vulnerability CVE-2026-84376 affects version 2.10.15-tuxcare.4 of astro, and is fixed in 2.10.15-tuxcare.9." }, { "status": "affected", "products": [ { "@id": "pkg:npm/astro@2.10.15-tuxcare.4", "identifiers": { "purl": "pkg:npm/astro@2.10.15-tuxcare.4" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-26w7-cxv4-gfx2 affects version 2.10.15-tuxcare.4 of astro, and is fixed in 2.10.15-tuxcare.9.", "vulnerability": { "name": "GHSA-26w7-cxv4-gfx2" }, "action_statement": "Vulnerability GHSA-26w7-cxv4-gfx2 affects version 2.10.15-tuxcare.4 of astro, and is fixed in 2.10.15-tuxcare.9." }, { "status": "affected", "products": [ { "@id": "pkg:npm/astro@2.10.15-tuxcare.4", "identifiers": { "purl": "pkg:npm/astro@2.10.15-tuxcare.4" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-4g3v-8h47-v7g6 affects version 2.10.15-tuxcare.4 of astro, and is fixed in 2.10.15-tuxcare.8.", "vulnerability": { "name": "GHSA-4g3v-8h47-v7g6" }, "action_statement": "Vulnerability GHSA-4g3v-8h47-v7g6 affects version 2.10.15-tuxcare.4 of astro, and is fixed in 2.10.15-tuxcare.8." } ] }