CVE-2026-33768

CVE-2026-33768 is a critical unauthenticated path override vulnerability affecting the Astro web framework's @astrojs/vercel serverless entrypoint prior to version 10.0.2. This flaw allows attackers to bypass platform-level path restrictions by manipulating the x-astro-path header or query parameter, enabling access to protected resources with any HTTP method. Rated 9.1 CRITICAL, it requires no authentication or user interaction and has a network attack vector, leading to high confidentiality and integrity impacts. While no public exploit code or active exploitation has been observed, and community attention is low, immediate patching to version 10.0.2 or later is strongly recommended.