CVE-2026-33768 is a missing authorization flaw in the @astrojs/vercel adapter for Astro. NVD scores it 6.5. The serverless entrypoint trusts an x-astro-path header or x_astro_path query parameter to rewrite the internal path. Upgrade to 10.0.2. Check any app that relies on platform rules to hide private routes.
What's affected
Versions of @astrojs/vercel before 10.0.2 are affected. Per the record, the issue shows on deployments without Edge Middleware. It lets a request bypass Vercel's platform level path restrictions, and the original method and body are kept, so POST, PUT and DELETE are covered. A firewall rule that blocks an admin path would not stop a request to another path that is rewritten to it.
How to check if you're exposed
npm ls @astrojs/vercel
Anything below 10.0.2 needs the update. Then review whether you rely on Vercel firewall or path rules to protect routes, and whether Edge Middleware is in front of the app.
What to do now
- Upgrade
@astrojs/vercelto 10.0.2 or later and redeploy. - Do not use path based platform rules as the only protection for sensitive routes. Check authentication inside the route handlers.
- Review logs for requests carrying the override header or query parameter.
Why it matters
The record uses CWE-441, unintended proxy or intermediary, and CWE-862, missing authorization. An internal routing hook was readable by any client. The lesson is to authorize at the route that does the work. The record is not marked as exploited in the wild and is not in CISA KEV.
The wider point is where authorization lives. A platform rule that blocks a path is useful, but it sees the path the client sent. If the application then changes the path internally, the rule and the route no longer agree. Put an authorization check in the handler of every sensitive route, so the answer does not depend on what any layer in front of it believed. After upgrading, test a protected route by sending the override header and the query parameter and confirm the app does not honor them.
Quick check
Does a firewall rule protect me?
Not reliably on affected versions, because the request can arrive on an allowed path and be rewritten.
Sources
Last reviewed: 19 October 2026.
