{"action":"Upgrade astro to 6.1.10 or later.","affected":[{"fixed":"6.1.10","introduced":"0"}],"component":"astro","cve_ids":["CVE-2026-45028"],"ecosystem":"npm","epss":0.00144,"exploited":false,"fixed_versions":["6.1.10"],"ghsa_id":"GHSA-xr5h-phrj-8vxv","id":"tcs_01M5KGJQ2M11TJ3GGM5R2K6VP7","modified_at":"2026-05-14T20:52:35.407280Z","published_at":"2026-05-13T01:36:39Z","references":["https://osv.dev/vulnerability/GHSA-xr5h-phrj-8vxv","https://github.com/withastro/astro/security/advisories/GHSA-xr5h-phrj-8vxv","https://nvd.nist.gov/vuln/detail/CVE-2026-45028","https://github.com/withastro/astro/pull/16457","https://github.com/withastro/astro/commit/3d82220a1549e699e34ed433f3846a919f4c02bd","https://github.com/withastro/astro"],"severity":{"label":"medium","score":6.1},"sources":[{"source":"osv","source_id":"GHSA-xr5h-phrj-8vxv","url":"https://osv.dev/vulnerability/GHSA-xr5h-phrj-8vxv"}],"summary":"Astro: Server island encrypted parameters vulnerable to cross-component replay"}