Repository navigation
Update dependency astro to v7.4.7 [SECURITY] - #2009
Merged
Merged
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This PR contains the following updates:
7.4.2→7.4.7Astro: XSS via attribute injection in dynamic tag names
CVE-2026-126361 / GHSA-mh32-jxcr-mh9f
More information
Details
Summary
When a dynamic tag (
const Tag = ...; <Tag />) resolves to a string, Astro renders it as a raw HTML element name. The name was filtered to remove characters that could inject attributes, but the filter did not handle/. Because HTML parsers treat/inside a tag as an attribute separator, a tag name such asimg/src/> was rendered as an<img>element with anonerrorattribute. The JSX renderer used for MDX did not filter string tag names at all.For example:
rendered
?as=img/src/> as live HTML.Impact
Reflected or stored cross-site scripting, but only in applications that use untrusted input (such as a request parameter or an uncontrolled CMS field) as all or part of an element name. Astro itself never derives element names from request data.
Applications that let content choose an element should map that input to a fixed set of known tags. Letting untrusted input choose an element name is unsafe even with a correct filter, because it can still select elements such as
scriptoriframe.Affected versions
astro<= 7.4.4.Patches
Fixed in
astro7.4.5. String tag names in.astrodynamic tags, JSX, and MDX now render only the leading valid element name, so characters such as/or=can no longer change the generated markup. Strings that do not start with a valid element name now throw an error.Workarounds
Upgrade to
astro7.4.5 or later. Before upgrading, do not use untrusted input as an element name, or map it to a fixed set of known tags.Credits
Reported by @uttej-badwane.
Severity
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:NReferences
This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).
Astro: Image endpoint in @astrojs/node can read files from a case-variant sibling of the output directory on case-sensitive filesystems
CVE-2026-126364 / GHSA-r3h5-4585-7x3w
More information
Details
Summary
The
/_imageendpoint used by the@astrojs/nodeadapter checks that a requested local image is inside the build output directory before reading it from disk. That check compared paths case-insensitively. On case-sensitive filesystems (such as Linux), a directory whose path differs from the output directory only by letter case is a different directory, but it passed the check.For example, with the client output directory at
/srv/app/dist/client/, a request such as:resolved to
/srv/app/DIST/client/secret.pngand was served, even though that file is outside the output directory.Impact
An unauthenticated attacker can read image files from outside the output directory, but only when all of the following are true:
@astrojs/nodeadapter.DIST/clientnext todist/client). Such a layout is unusual, and the attacker cannot create it.Only files the image service accepts can be read. Raster images are returned after resizing; SVG files are returned unchanged. Other file types fail during processing. Plain path traversal outside the output directory (for example
/../../secret.png) was already rejected and is not affected.Affected versions
astro>= 5.14.3, <= 7.4.6, when used with@astrojs/node(all versions up to 11.1.11). The vulnerable image endpoint is provided byastroand used by the@astrojs/nodeadapter.Patches
Fixed in
astro7.4.7. The path check now compares paths exactly, and only ignores letter case for Windows drive-letter paths. The fix ships inastro, so upgrading@astrojs/nodealone is not enough.Workarounds
Upgrade to
astro7.4.7 or later. Before upgrading, make sure no directory next to the build output directory has a path that differs from it only by letter case.Credits
Reported by @zachariah-mithani.
Severity
CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:NReferences
This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).
Release Notes
withastro/astro (astro)
v7.4.7Compare Source
Patch Changes
7da442bThanks @matthewp! - Fixes the image endpoint treating directories whose names differ only by letter case as being inside the build output directory on case-sensitive filesystems7da442b]:v7.4.6Compare Source
Patch Changes
#18565
cd09986Thanks @praveen-kumary! - Avoids attributing client-only components or scripts to unrelated pages importingastro:i18nby bounding top-level page graph traversal at virtual page entries#18608
babd96dThanks @umeraamir69! - Fixes an extra page reload on the first page load after startingastro devwithout an existing.astrodirectory#18589
402c0faThanks @astro-factory! - Fixesastro checkexiting with code 0 when@astrojs/checkortypescriptis not installed. The command now exits with code 1 so CI fails instead of silently skipping type checking.#18503
54fcdd5Thanks @SwastikTripathi! - Preserves the last-modified date of cached font files and unchanged public files when copying them into the build output. Public-file timestamp preservation respects the resolved public-directory configuration, follows source symlinks, and avoids backdating files overwritten by build plugins.#18605
76cd239Thanks @astro-factory! - Fixes theglob()loader adding files from a folder excluded with a negation pattern such as!_docswhen they change duringastro dev#18432
ed60d82Thanks @alexmv! - Improves theMissingSharperror to include the reason Sharp failed to load, such as its prebuilt binaries not supporting the current CPU#18474
59543c3Thanks @miottid! - Fixes i18n fallback for on-demand rendered pages. A locale-prefixed request for a page that only exists in the fallback locale (for example/de/aboutwithfallback: { de: 'en' }) was answered with status302and noLocationheader. Such requests are now rewritten or redirected to the fallback locale according toi18n.routing.fallbackType, including encoded paths and sites with a configuredbase. Query strings are preserved, and explicit page statuses and redirects are left unchanged.#18541
cfa2d2bThanks @ump45nose! - FixesmatchAllRoutesto considerfallbackRoutes, matchingmatchRouteand the production router. Dev-server i18n fallback requests now resolve to the source route's metadata instead of the 404 route, and SSR-only fallback candidates can fall through the prerender handler.#18602
d856064Thanks @astro-factory! - Fixesastro checklosing the end of its output, including theResultsummary, when stdout is piped 8000 to a slow reader. When the reader closes the pipe early, for exampleastro check | head,astro checknow exits with code 1 instead of crashing with anEPIPEstack trace.#18574
da0f149Thanks @astro-factory! - Fixes an unnecessary full page reload inastro devwhen a content loader callsstore.clear()orstore.delete()and the content store has no asset imports#18570
e71c038Thanks @astro-factory! - Fixes pages using<ClientRouter />briefly showing the top of the page on reload before jumping back to the previous scroll position. Full reloads now use the browser's native scroll restoration.#18531
f75553bThanks @praveen-kumary! - Fixes an unhandledTypeError: Cannot convert undefined or null to objectwhen callingroute.generate()without arguments on static routesv7.4.5Compare Source
Patch Changes
#18558
fac3c50Thanks @astro-factory! - Fixesastro dev statusand other background server commands deleting the lock file of a running dev or preview server when run from a sandbox or as another user that is not permitted to signal its process#18559
10dae2fThanks @astro-factory! - Fixesimport.meta.envvalues containing$sequences (such as$$or$&) being corrupted inastro buildwhen server code reads theimport.meta.envobject directly, for example withconst { MY_SECRET } = import.meta.env#18544
e3bec3dThanks @skezo! - Fixes request paths with invalid percent-encoding (e.g./%C0%AFor a bare%) being logged as anInvalid URL encodingerror and routed with the undecoded path. These requests now return a400, the same as a path that is encoded too many times.#18520
e023abaThanks @matthewp! - Makes rendering of string tag names stricter and consistent across.astrodynamic tags, JSX, and MDX. Only the leading part of the string that is a valid element name is rendered, so characters such as/or=can no longer change the generated markup. A string that does not start with a valid element name (for example'!--'or'') now throws an error instead of producing invalid HTML.v7.4.4Compare Source
Patch Changes
df838daThanks @edmundhung! - Allowsastro addto configure tagged versions of official adaptersv7.4.3Compare Source
Patch Changes
#18488
e4e25faThanks @umeraamir69! - CSP no longer hashes empty children on external stylesheets and scripts, which was inserting the SHA-256 of the empty string intoscript-srcandstyle-src.#18500
e5a3a1bThanks @astro-factory! - Fixes<Image>and<Picture>emitting duplicatesrcsetcandidates whendensitiescontains equivalent values such as1and'1x'#18517
c3185b7Thanks @okxint! - Fix unhandledAbortErrorrejection whenClientRouterskips a pending view transition#18497
c712113Thanks @astro-factory! - Fixes an uncaughtTypeErrorin the browser when aserver:deferisland request fails due to a network error. The fallback content is kept, as it is for non-200 responses.#18525
d0240b9Thanks @astro-factory! - Fixes aDEP0190deprecation warning printed byastro infoon Node.js 24 and later#18522
776b9a6Thanks @astro-factory! - FixesmemoryCache()serving an empty body for cached pages that return an empty404or500response. These responses now render the404or500error page on every request.#18511
d060ff9Thanks @astro-factory! - Fixestransition:namestyles missing in dev when the element is inside a component that is only rendered through another component with no styles or scripts#18494
5fe699cThanks @astro-factory! - Fixes theastroCLI refusing to run on StackBlitz by allowing Node.js>=22.22.0inside WebContainers, whose Node.js version users cannot change#18506
bf43a60Thanks @astro-factory! - Fixes<ClientRouter />animating scroll restoration on back/forward navigation whenscroll-behavior: smoothis set. Saved scroll positions are now restored instantly, matching the browser's native behavior.#18476
8ea79a2Thanks @astro-factory! - Fixes aDataCloneErrorcrash when building pages that render SVG imports with<Image />orgetImage()whileexperimental.parallelPrerenderis enabled.#18504
6dbd737Thanks @astro-factory! - Fixes<Picture>emitting a duplicate1xcandidate in<source>srcsetwhendensitiesincludes1#18524
7524889Thanks @astro-factory! - Fixes type errors reported in Astro's built-in<Image />,<Picture />,<Code />,<Debug />and<ClientRouter />components when type-checking a project that extendsastro/tsconfigs/strictestwithtscand@astrojs/ts-content-mapper#18493
3773941Thanks @astro-factory! - Fixes scoped styles of unused Astro components being included in the build when those components are re-exported from a barrel file#18512
1151b9eThanks @jp-knj! - Fixes CSP hashes added withAstro.cspfrom components rendered inside<body>being left out of the CSP<meta>element in static builds, including MDX pagesUpdated dependencies [
6cf3423,edfbf4a]:Configuration
📅 Schedule: (UTC)
🚦 Automerge: Enabled.
♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
This PR has been generated by Mend Renovate CLI.