Astro: Unauthenticated path override in the @astrojs/vercel ISR function

Summary

When ISR is enabled, the serverless entrypoint lets an unauthenticated request decide which route the origin renders. The internal _isr function reads the x_astro_path query parameter and rewrites the request path to it without any authentication. Edge level access controls only ever see the /_isr path, so they do not apply to the route that actually gets rendered. This is the same confused deputy problem as CVE-2026-33768, reachable again through the ISR path.

Impact

This affects apps that use @astrojs/vercel with isr: true and protect routes at the edge. Two common setups are affected:

1. Path rules or firewall deny rules configured on Vercel (for example blocking /admin).
2. Split deployments (edgeMiddleware: true) where authorization lives in Astro middleware, since that middleware runs at the edge and not in the origin.

An attacker reads any GET rendered route by requesting /_isr?x_astro_path=/the/protected/path. No credentials are required. The protected content is produced by a fresh origin render, so the attack does not depend on the response being cached first.

Details

packages/integrations/vercel/src/serverless/entrypoint.ts picks the real path like this:

if (hasValidMiddlewareSecret) {
  realPath = request.headers.get(ASTRO_PATH_HEADER);       // secret checked
} else if (request.headers.get('x-vercel-isr') === '1') {
  realPath = url.searchParams.get(ASTRO_PATH_PARAM);        // no secret checked
}

The header path is gated by the per build secret and is fine. The ISR branch is not. Two facts make it reachable by anyone:

1. The _isr function is publicly addressable.
2. Vercel sets x-vercel-isr: 1 on requests to it, including direct external requests, so the attacker does not even need to send that header.

So GET /_isr?x_astro_path=/admin sets the internal path to /admin and renders it. The edge saw only /_isr, which is allowed, so any path based rule on /admin never fires. In split deployments the edge middleware also runs against /_isr, and the origin does not run middleware at all, so middleware based auth is skipped as well.

How this regressed

CVE-2026-33768 was fixed in 10.0.2 by commit 335a204161 (PR #15959), which required the secret for every path override and removed the query parameter source. Commit aa266364fe (PR #16079, "Fix ISR path rewrite to prevent 404") brought the query parameter back, guarded only by the header. That header is not a security boundary, so the fix was effectively undone for ISR routes starting in 10.0.3.