{ "@id": "urn:uuid:c16bae75-1e98-45e7-9778-df320e007bfc", "role": "Document Creator", "author": "https://tuxcare.com", "version": 9, "@context": "https://openvex.dev/ns/v0.2.0", "timestamp": "2026-10-29T16:39:32.016379+00:00", "statements": [ { "status": "affected", "products": [ { "@id": "pkg:npm/astro@1.9.2-tuxcare.5", "identifiers": { "purl": "pkg:npm/astro@1.9.2-tuxcare.5" } } ], "timestamp": "2026-10-29T07:04:28.598882+00:00", "status_notes": "Vulnerability CVE-2024-47885 affects version 1.9.2-tuxcare.5 of astro.", "vulnerability": { "name": "CVE-2024-47885" }, "action_statement": "Vulnerability CVE-2024-47885 affects version 1.9.2-tuxcare.5 of astro." }, { "status": "fixed", "products": [ { "@id": "pkg:npm/astro@1.9.2-tuxcare.5", "identifiers": { "purl": "pkg:npm/astro@1.9.2-tuxcare.5" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-56140 is fixed in version 1.9.2-tuxcare.5 of astro.", "vulnerability": { "name": "CVE-2024-56140" } }, { "status": "fixed", "products": [ { "@id": "pkg:npm/astro@1.9.2-tuxcare.5", "identifiers": { "purl": "pkg:npm/astro@1.9.2-tuxcare.5" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-56159 is fixed in version 1.9.2-tuxcare.5 of astro.", "vulnerability": { "name": "CVE-2024-56159" } }, { "status": "affected", "products": [ { "@id": "pkg:npm/astro@1.9.2-tuxcare.5", "identifiers": { "purl": "pkg:npm/astro@1.9.2-tuxcare.5" } } ], "timestamp": "2026-10-29T07:05:56.841018+00:00", "status_notes": "Vulnerability CVE-2025-54793 affects version 1.9.2-tuxcare.5 of astro.", "vulnerability": { "name": "CVE-2025-54793" }, "action_statement": "Vulnerability CVE-2025-54793 affects version 1.9.2-tuxcare.5 of astro." }, { "status": "fixed", "products": [ { "@id": "pkg:npm/astro@1.9.2-tuxcare.5", "identifiers": { "purl": "pkg:npm/astro@1.9.2-tuxcare.5" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-55303 is fixed in version 1.9.2-tuxcare.5 of astro.", "vulnerability": { "name": "CVE-2025-55303" } }, { "status": "affected", "products": [ { "@id": "pkg:npm/astro@1.9.2-tuxcare.5", "identifiers": { "purl": "pkg:npm/astro@1.9.2-tuxcare.5" } } ], "timestamp": "2026-10-29T07:00:16.985656+00:00", "status_notes": "Vulnerability CVE-2025-59837 affects version 1.9.2-tuxcare.5 of astro.", "vulnerability": { "name": "CVE-2025-59837" }, "action_statement": "Vulnerability CVE-2025-59837 affects version 1.9.2-tuxcare.5 of astro." }, { "status": "fixed", "products": [ { "@id": "pkg:npm/astro@1.9.2-tuxcare.5", "identifiers": { "purl": "pkg:npm/astro@1.9.2-tuxcare.5" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-61925 is fixed in version 1.9.2-tuxcare.5 of astro.", "vulnerability": { "name": "CVE-2025-61925" } }, { "status": "affected", "products": [ { "@id": "pkg:npm/astro@1.9.2-tuxcare.5", "identifiers": { "purl": "pkg:npm/astro@1.9.2-tuxcare.5" } } ], "timestamp": "2026-10-29T07:04:28.598882+00:00", "status_notes": "Vulnerability CVE-2025-64525 affects version 1.9.2-tuxcare.5 of astro.", "vulnerability": { "name": "CVE-2025-64525" }, "action_statement": "Vulnerability CVE-2025-64525 affects version 1.9.2-tuxcare.5 of astro." }, { "status": "affected", "products": [ { "@id": "pkg:npm/astro@1.9.2-tuxcare.5", "identifiers": { "purl": "pkg:npm/astro@1.9.2-tuxcare.5" } } ], "timestamp": "2026-10-29T07:00:16.985656+00:00", "status_notes": "Vulnerability CVE-2025-64745 affects version 1.9.2-tuxcare.5 of astro.", "vulnerability": { "name": "CVE-2025-64745" }, "action_statement": "Vulnerability CVE-2025-64745 affects version 1.9.2-tuxcare.5 of astro." }, { "status": "fixed", "products": [ { "@id": "pkg:npm/astro@1.9.2-tuxcare.5", "identifiers": { "purl": "pkg:npm/astro@1.9.2-tuxcare.5" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-64757 is fixed in version 1.9.2-tuxcare.5 of astro.", "vulnerability": { "name": "CVE-2025-64757" } }, { "status": "fixed", "products": [ { "@id": "pkg:npm/astro@1.9.2-tuxcare.5", "identifiers": { "purl": "pkg:npm/astro@1.9.2-tuxcare.5" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-64764 is fixed in version 1.9.2-tuxcare.5 of astro.", "vulnerability": { "name": "CVE-2025-64764" } }, { "status": "fixed", "products": [ { "@id": "pkg:npm/astro@1.9.2-tuxcare.5", "identifiers": { "purl": "pkg:npm/astro@1.9.2-tuxcare.5" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-64765 is fixed in version 1.9.2-tuxcare.5 of astro.", "vulnerability": { "name": "CVE-2025-64765" } }, { "status": "fixed", "products": [ { "@id": "pkg:npm/astro@1.9.2-tuxcare.5", "identifiers": { "purl": "pkg:npm/astro@1.9.2-tuxcare.5" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-65019 is fixed in version 1.9.2-tuxcare.5 of astro.", "vulnerability": { "name": "CVE-2025-65019" } }, { "status": "fixed", "products": [ { "@id": "pkg:npm/astro@1.9.2-tuxcare.5", "identifiers": { "purl": "pkg:npm/astro@1.9.2-tuxcare.5" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-66202 is fixed in version 1.9.2-tuxcare.5 of astro.", "vulnerability": { "name": "CVE-2025-66202" } }, { "status": "affected", "products": [ { "@id": "pkg:npm/astro@1.9.2-tuxcare.5", "identifiers": { "purl": "pkg:npm/astro@1.9.2-tuxcare.5" } } ], "timestamp": "2026-10-29T07:08:50.234059+00:00", "status_notes": "Vulnerability CVE-2026-114127 affects version 1.9.2-tuxcare.5 of astro.", "vulnerability": { "name": "CVE-2026-114127" }, "action_statement": "Vulnerability CVE-2026-114127 affects version 1.9.2-tuxcare.5 of astro." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/astro@1.9.2-tuxcare.5", "identifiers": { "purl": "pkg:npm/astro@1.9.2-tuxcare.5" } } ], "timestamp": "2026-10-22T19:31:13.816905+00:00", "status_notes": "Vulnerability CVE-2026-114128 does not affect version 1.9.2-tuxcare.5 of astro. not_affected \u2014 Version 1.9.2 is NOT affected by CVE-2026-114128. The vulnerable code (`prerenderElementChildren` function that marks script/style children as raw HTML) was introduced in version 2.1.1 (March 2023) and fixed in version 7.3.2 (September 2026). Version 1.9.2 predates the vulnerability introduction and properly escapes all string children through the `escapeHTML` function in `renderJSX`.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-114128" }, "impact_statement": "not_affected \u2014 Version 1.9.2 is NOT affected by CVE-2026-114128. The vulnerable code (`prerenderElementChildren` function that marks script/style children as raw HTML) was introduced in version 2.1.1 (March 2023) and fixed in version 7.3.2 (September 2026). Version 1.9.2 predates the vulnerability introduction and properly escapes all string children through the `escapeHTML` function in `renderJSX`." }, { "status": "affected", "products": [ { "@id": "pkg:npm/astro@1.9.2-tuxcare.5", "identifiers": { "purl": "pkg:npm/astro@1.9.2-tuxcare.5" } } ], "timestamp": "2026-10-29T07:04:28.598882+00:00", "status_notes": "Vulnerability CVE-2026-33769 affects version 1.9.2-tuxcare.5 of astro.", "vulnerability": { "name": "CVE-2026-33769" }, "action_statement": "Vulnerability CVE-2026-33769 affects version 1.9.2-tuxcare.5 of astro." }, { "status": "fixed", "products": [ { "@id": "pkg:npm/astro@1.9.2-tuxcare.5", "identifiers": { "purl": "pkg:npm/astro@1.9.2-tuxcare.5" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-41067 is fixed in version 1.9.2-tuxcare.5 of astro.", "vulnerability": { "name": "CVE-2026-41067" } }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/astro@1.9.2-tuxcare.5", "identifiers": { "purl": "pkg:npm/astro@1.9.2-tuxcare.5" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-45028 does not affect version 1.9.2-tuxcare.5 of astro. not_affected \u2014 Astro version 1.9.2 is not affected by CVE-2026-45028. The vulnerability concerns server islands, a feature that encrypts component parameters (props, slots, componentExport) using AES-GCM without binding ciphertext to component/parameter context, allowing replay attacks. However, the server islands feature does not exist in version 1.9.2. This feature was introduced much later (PR #11305) in A...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-45028" }, "impact_statement": "not_affected \u2014 Astro version 1.9.2 is not affected by CVE-2026-45028. The vulnerability concerns server islands, a feature that encrypts component parameters (props, slots, componentExport) using AES-GCM without binding ciphertext to component/parameter context, allowing replay attacks. However, the server islands feature does not exist in version 1.9.2. This feature was introduced much later (PR #11305) in A..." }, { "status": "fixed", "products": [ { "@id": "pkg:npm/astro@1.9.2-tuxcare.5", "identifiers": { "purl": "pkg:npm/astro@1.9.2-tuxcare.5" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-50146 is fixed in version 1.9.2-tuxcare.5 of astro.", "vulnerability": { "name": "CVE-2026-50146" } }, { "status": "fixed", "products": [ { "@id": "pkg:npm/astro@1.9.2-tuxcare.5", "identifiers": { "purl": "pkg:npm/astro@1.9.2-tuxcare.5" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-54298 is fixed in version 1.9.2-tuxcare.5 of astro.", "vulnerability": { "name": "CVE-2026-54298" } }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/astro@1.9.2-tuxcare.5", "identifiers": { "purl": "pkg:npm/astro@1.9.2-tuxcare.5" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-54299 does not affect version 1.9.2-tuxcare.5 of astro. not_affected \u2014 Astro version 1.9.2 is not affected by CVE-2026-54299. The vulnerability requires the prerendered error page HTTP fetching feature, which was introduced in Astro 5.12.9+. Version 1.9.2 renders all error pages in-process using the component system, not via HTTP fetch, eliminating the SSRF attack vector.", "justification": "vulnerable_code_not_in_execute_path", "vulnerability": { "name": "CVE-2026-54299" }, "impact_statement": "not_affected \u2014 Astro version 1.9.2 is not affected by CVE-2026-54299. The vulnerability requires the prerendered error page HTTP fetching feature, which was introduced in Astro 5.12.9+. Version 1.9.2 renders all error pages in-process using the component system, not via HTTP fetch, eliminating the SSRF attack vector." }, { "status": "affected", "products": [ { "@id": "pkg:npm/astro@1.9.2-tuxcare.5", "identifiers": { "purl": "pkg:npm/astro@1.9.2-tuxcare.5" } } ], "timestamp": "2026-10-29T07:05:56.841018+00:00", "status_notes": "Vulnerability CVE-2026-59727 affects version 1.9.2-tuxcare.5 of astro.", "vulnerability": { "name": "CVE-2026-59727" }, "action_statement": "Vulnerability CVE-2026-59727 affects version 1.9.2-tuxcare.5 of astro." }, { "status": "affected", "products": [ { "@id": "pkg:npm/astro@1.9.2-tuxcare.5", "identifiers": { "purl": "pkg:npm/astro@1.9.2-tuxcare.5" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-59729 affects version 1.9.2-tuxcare.5 of astro, and is fixed in 1.9.2-tuxcare.6.", "vulnerability": { "name": "CVE-2026-59729" }, "action_statement": "Vulnerability CVE-2026-59729 affects version 1.9.2-tuxcare.5 of astro, and is fixed in 1.9.2-tuxcare.6." }, { "status": "affected", "products": [ { "@id": "pkg:npm/astro@1.9.2-tuxcare.5", "identifiers": { "purl": "pkg:npm/astro@1.9.2-tuxcare.5" } } ], "timestamp": "2026-10-29T07:04:28.598882+00:00", "status_notes": "Vulnerability CVE-2026-59731 affects version 1.9.2-tuxcare.5 of astro.", "vulnerability": { "name": "CVE-2026-59731" }, "action_statement": "Vulnerability CVE-2026-59731 affects version 1.9.2-tuxcare.5 of astro." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/astro@1.9.2-tuxcare.5", "identifiers": { "purl": "pkg:npm/astro@1.9.2-tuxcare.5" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-73422 does not affect version 1.9.2-tuxcare.5 of astro. not_affected \u2014 Astro version 1.9.0 is not affected by CVE-2026-73422. The View Transitions feature\u2014which contains the vulnerable code path where animation property values are embedded in generated CSS without escaping\u2014does not exist in this version. View Transitions were introduced in Astro 2.9 (mid-2023), while version 1.9.0 is from late 2022. The vulnerable file `packages/astro/src/runtime/server/transition...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-73422" }, "impact_statement": "not_affected \u2014 Astro version 1.9.0 is not affected by CVE-2026-73422. The View Transitions feature\u2014which contains the vulnerable code path where animation property values are embedded in generated CSS without escaping\u2014does not exist in this version. View Transitions were introduced in Astro 2.9 (mid-2023), while version 1.9.0 is from late 2022. The vulnerable file `packages/astro/src/runtime/server/transition..." }, { "status": "affected", "products": [ { "@id": "pkg:npm/astro@1.9.2-tuxcare.5", "identifiers": { "purl": "pkg:npm/astro@1.9.2-tuxcare.5" } } ], "timestamp": "2026-10-29T07:10:42.705931+00:00", "status_notes": "Vulnerability CVE-2026-73423 affects version 1.9.2-tuxcare.5 of astro.", "vulnerability": { "name": "CVE-2026-73423" }, "action_statement": "Vulnerability CVE-2026-73423 affects version 1.9.2-tuxcare.5 of astro." }, { "status": "affected", "products": [ { "@id": "pkg:npm/astro@1.9.2-tuxcare.5", "identifiers": { "purl": "pkg:npm/astro@1.9.2-tuxcare.5" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-84376 affects version 1.9.2-tuxcare.5 of astro, and is fixed in 1.9.2-tuxcare.7.", "vulnerability": { "name": "CVE-2026-84376" }, "action_statement": "Vulnerability CVE-2026-84376 affects version 1.9.2-tuxcare.5 of astro, and is fixed in 1.9.2-tuxcare.7." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/astro@1.9.2-tuxcare.5", "identifiers": { "purl": "pkg:npm/astro@1.9.2-tuxcare.5" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-26w7-cxv4-gfx2 does not affect version 1.9.2-tuxcare.5 of astro. not_affected \u2014 Astro 1.9.2 is not affected by GHSA-26w7-cxv4-gfx2 (libheif RCE via malicious AVIF). The vulnerability exists in libheif, used by Sharp, but Sharp is an OPTIONAL peer dependency that must be explicitly installed and configured. The DEFAULT image service in Astro 1.9.2 is Squoosh (WebAssembly-based), which processes AVIF images without using libheif. The vulnerable code path only exists when use...", "vulnerability": { "name": "GHSA-26w7-cxv4-gfx2" }, "impact_statement": "not_affected \u2014 Astro 1.9.2 is not affected by GHSA-26w7-cxv4-gfx2 (libheif RCE via malicious AVIF). The vulnerability exists in libheif, used by Sharp, but Sharp is an OPTIONAL peer dependency that must be explicitly installed and configured. The DEFAULT image service in Astro 1.9.2 is Squoosh (WebAssembly-based), which processes AVIF images without using libheif. The vulnerable code path only exists when use..." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/astro@1.9.2-tuxcare.5", "identifiers": { "purl": "pkg:npm/astro@1.9.2-tuxcare.5" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-4g3v-8h47-v7g6 does not affect version 1.9.2-tuxcare.5 of astro. not_affected \u2014 Astro version 1.9.2 does not contain View Transitions functionality. The vulnerable code path (packages/astro/src/runtime/server/transition.ts) does not exist because the View Transitions feature was introduced in a later version (around Astro 2.9+). The vulnerability requires View Transition animation properties to be processed and embedded in generated CSS, but this entire feature is absent f...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-4g3v-8h47-v7g6" }, "impact_statement": "not_affected \u2014 Astro version 1.9.2 does not contain View Transitions functionality. The vulnerable code path (packages/astro/src/runtime/server/transition.ts) does not exist because the View Transitions feature was introduced in a later version (around Astro 2.9+). The vulnerability requires View Transition animation properties to be processed and embedded in generated CSS, but this entire feature is absent f..." } ] }