CVE-2026-45028: XSS in Astro Server Islands

The core of this vulnerability lies in Astro's server islands feature and the AES-GCM encryption used to protect props and slots. Astro failed to properly bind the ciphertext to its intended component or parameter type. This means an attacker can intercept and replay an encrypted props value (p) as a slots value (s), or vice versa. Since slots contain raw, unescaped HTML, while props might contain user-controlled data, this replay attack can lead to XSS. Successful exploitation hinges on the application utilizing server islands and having at least two different server islands involved. The potential impact is the execution of arbitrary JavaScript in the user's browser, leading to data theft, session hijacking, or defacement of the application.

1. Réservé2026-05-08
2. Publiée2026-05-13
3. Modifiée2026-05-14
4. EPSS mis à jour2026-05-15

The primary mitigation is to upgrade to Astro version 6.1.11 or later, which addresses the ciphertext binding issue. If upgrading is not immediately feasible, consider implementing strict input validation and output encoding on all data passed to server islands, particularly within slots. While not a complete solution, this can reduce the attack surface. Additionally, review your Astro application's architecture to minimize the use of server islands where possible. There are no specific WAF rules or detection signatures readily available for this particular vulnerability, as it's a logic flaw rather than a direct exploit pattern. After upgrading, confirm the fix by testing the application with scenarios that previously triggered the vulnerability, ensuring props and slots are handled securely.