CVE-2026-54299

Name of the Vulnerable Software and Affected Versions Astro versions prior to 6.4.6

Description Astro SSR applications using prerendered error pages, such as '/404' or '/500' with export const prerender = true, fetch these pages over HTTP at runtime during an error. The fetch URL is derived from request.url, which obtains its origin from the incoming Host header. If the Host header is not validated against allowedDomains, an attacker can manipulate the header to point the fetch toward an arbitrary host and read the response. This occurs specifically in SSR deployments using createRequestFromNodeRequest from astro/app/node with app.render() without overriding prerenderedErrorPageFetch.

Recommendations Update to version 6.4.6 or later.