{"action":"Upgrade @astrojs/vercel to 10.0.2 or later.","affected":[{"fixed":"10.0.2","introduced":"0"}],"component":"@astrojs/vercel","cve_ids":["CVE-2026-33768"],"ecosystem":"npm","epss":0.00344,"exploited":false,"fixed_versions":["10.0.2"],"ghsa_id":"GHSA-mr6q-rp88-fx84","id":"tcs_01M5KG1K8HKPTMGBMPXJ5BA7Y2","modified_at":"2026-03-26T18:56:22.122282Z","published_at":"2026-03-26T18:41:34Z","references":["https://osv.dev/vulnerability/GHSA-mr6q-rp88-fx84","https://github.com/withastro/astro/security/advisories/GHSA-mr6q-rp88-fx84","https://nvd.nist.gov/vuln/detail/CVE-2026-33768","https://github.com/withastro/astro/pull/15959","https://github.com/withastro/astro/commit/335a204161f5a7293c128db570901d4f8639c6ed","https://github.com/advisories/GHSA-f82v-jwr5-mffw","https://github.com/withastro/astro","https://github.com/withastro/astro/releases/tag/@astrojs/vercel@10.0.2"],"severity":{"label":"medium","score":6.5},"sources":[{"source":"osv","source_id":"GHSA-mr6q-rp88-fx84","url":"https://osv.dev/vulnerability/GHSA-mr6q-rp88-fx84"}],"summary":"Astro: Unauthenticated Path Override via `x-astro-path` / `x_astro_path`"}