CVE-2024-56159: Astro Package Exposes Server Source Code via Sourcemaps
Summary
CVE-2024-56159: Astro's server source code is exposed to the public if sourcemaps are enabled. Affects astro across 2 version ranges.
< 4.16.18
>= 5.0.0-alpha.0, < 5.0.8
Fixed in 4.16.18 or 5.0.8, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Astro is a modern static site generator that allows developers to build fast websites using components from various frameworks. It supports server-side rendering (SSR) and static site generation (SSG), making it versatile for different project needs. However, a vulnerability exists in certain versions of Astro that can expose server source code if sourcemaps are enabled, potentially leading to unauthorized access to sensitive information.
Vulnerability Detail
A bug in the build process of Astro allows any unauthenticated user to access parts of the server source code when sourcemaps are enabled. During the build, sourcemap files for server code are moved to a publicly accessible folder, making them readable via unauthorized HTTP GET requests. This issue affects Astro versions 5.0.3 to 5.0.6 and all Astro 4 versions 4.16.17 or older. The predictable naming of sourcemap files, such as 'dist/client/pages/index.astro.mjs.map', increases the risk of exposure. Although secrets are not directly exposed, the revealed source code could lead to further vulnerabilities.
How To Fix
Latest published version: 7.4.2 as of 23 Oct 2026
npm install astro@7.4.2Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
< 4.16.184.16.18npm install astro@4.16.18 -
>= 5.0.0-alpha.0, < 5.0.85.0.8npm install astro@5.0.8
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary measure, users can disable sourcemaps in their build configuration to prevent the exposure of server source code until they can update to a patched version. This can typically be done by setting the sourcemaps option to false in the Astro configuration file.
Conclusion
The vulnerability CVE-2024-56159 in the Astro package poses a significant risk by exposing server source code through enabled sourcemaps. Users are strongly advised to update to the latest versions to protect their applications. Temporary workarounds are available, but the best course of action is to apply the patches as soon as possible.
See every vulnerability recorded for astro →
FAQ
The vulnerability allows unauthorized access to server source code, which could lead to the discovery of other vulnerabilities or sensitive information if present in the code.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
Astro versions 5.0.3 to 5.0.6 and all Astro 4 versions 4.16.17 or older are affected if sourcemaps are enabled.
While secrets are not directly exposed, any sensitive information present in the source code could be accessed if the code is revealed.
If you cannot update immediately, disable sourcemaps in your build configuration to mitigate the risk until you can apply the patch.
References
Related vulnerabilities
Recent vulnerabilities recorded for astro.
