Astro 4 lifecycle
Current status
Astro 4 is currently in standard support.
Security: 15 tracked advisories affecting this line. Details below — lifecycle and vulnerability status are separate.
Official lifecycle source: Astro npm releases
- Support phase
- standard support
- End of life
- Not officially published
- Latest release
- 4.0.1
- Released
- 5 Dec 2023
At a glance
- Version line
- 4
- Initial release
- 5 Dec 2023
- Lifecycle phase
- standard support
- Latest stable
- 4.0.1
- Latest release date
- 5 Dec 2023
- EOL
- Not officially published
- Risk
- low
- Releases tracked
- 145
Lifecycle timeline
Phases from published LifecyclePeriod records. Missing phases are not inferred.
Release
5 Dec 2023
standard supportcurrent
5 Dec 2023 → —
Source: Astro npm releases
Astro 4 is currently in standard support.
Upgrade options
Newer supported Astro version lines from CompatHub lifecycle data. Compatibility and security context use existing evidence only.
You are on Astro 4
Supported
Supported upgrade options
- Astro 7Upgrade planner →Supported· 3 major versions newer
- Astro 6Upgrade planner →Supported· 2 major versions newer
- Astro 5Upgrade planner →Supported· 1 major version newer
Security
Advisories affecting Astro 4 (OSV.dev evidence). Known exploited status, due dates, and ransomware use from CISA KEV when matched.
- Known vulnerabilities
- 15
- Known exploited
- 0
- Highest CVSS
- 7.5
- CVE-2026-54299GHSA-2pvr-wf23-7pc7
Astro: Host header SSRF in prerendered error page fetch
- CVSS:
- 7.5 (high) · NVD
- CWE:
- CWE-20, CWE-918
- Affected:
- <6.4.6
- Fixed in:
- 6.4.6
- Source:
- OSV source · Advisory
- CVE-2026-50146GHSA-8hv8-536x-4wqp
Astro: Reflected XSS via unescaped slot name
- CVSS:
- 6.1 (moderate) · NVD
- CWE:
- CWE-80
- Affected:
- <6.3.3
- Fixed in:
- 6.3.3
- Source:
- OSV source · Advisory
- CVE-2026-59729GHSA-f48w-9m4c-m7f5
Astro: XSS via unescaped spread attribute names in renderHTMLElement (incomplete fix for CVE-2026-54298)
- CVSS:
- 5.1 (moderate) · NVD
- CWE:
- CWE-79
- Affected:
- <7.0.6
- Fixed in:
- 7.0.6
- Source:
- OSV source · Advisory
- CVE-2026-54298GHSA-jrpj-wcv7-9fh9
Astro: XSS via Unescaped Attribute Names in Spread Props
- Affected:
- <6.4.6
- Fixed in:
- 6.4.6
- Source:
- OSV source · Advisory
- CVE-2026-45028GHSA-xr5h-phrj-8vxv
Astro: Server island encrypted parameters vulnerable to cross-component replay
- Affected:
- <6.1.10
- Fixed in:
- 6.1.10
- Source:
- OSV source · Advisory
- CVE-2026-41067GHSA-j687-52p2-xcff
Astro: XSS in define:vars via incomplete </script> tag sanitization
- Affected:
- <6.1.6
- Fixed in:
- 6.1.6
- Source:
- OSV source · Advisory
- CVE-2025-66202GHSA-whqg-ppgf-wp8c
Astro has an Authentication Bypass via Double URL Encoding, a bypass for CVE-2025-64765
- Affected:
- <5.15.8
- Fixed in:
- 5.15.8
- Source:
- OSV source · Advisory
- CVE-2025-65019GHSA-fvmw-cj7j-j39q
Astro Cloudflare adapter has Stored Cross-site Scripting vulnerability in /_image endpoint
- Affected:
- <5.15.9
- Fixed in:
- 5.15.9
- Source:
- OSV source · Advisory
- CVE-2025-64765GHSA-ggxq-hp9w-j794
Astro's middleware authentication checks based on url.pathname can be bypassed via url encoded values
- Affected:
- <5.15.8
- Fixed in:
- 5.15.8
- Source:
- OSV source · Advisory
- CVE-2025-64764GHSA-wrwg-2hg8-v723
Astro vulnerable to reflected XSS via the server islands feature
- Affected:
- <5.15.8
- Fixed in:
- 5.15.8
- Source:
- OSV source · Advisory
- CVE-2025-64757GHSA-x3h8-62x9-952g
Astro Development Server has Arbitrary Local File Read
- Affected:
- <5.14.3
- Fixed in:
- 5.14.3
- Source:
- OSV source · Advisory
- CVE-2025-61925GHSA-5ff5-9fcw-vg88
Astro's `X-Forwarded-Host` is reflected without validation
- Affected:
- <5.14.3
- Fixed in:
- 5.14.3
- Source:
- OSV source · Advisory
- CVE-2025-55303GHSA-xf8x-j4p2-f749
Astro allows unauthorized third-party images in _image endpoint
- Affected:
- <4.16.19
- Fixed in:
- 4.16.19
- Source:
- OSV source · Advisory
- CVE-2024-56159GHSA-49w6-73cw-chjr
Astro's server source code is exposed to the public if sourcemaps are enabled
- Affected:
- <4.16.18
- Fixed in:
- 4.16.18
- Source:
- OSV source · Advisory
- CVE-2024-56140GHSA-c4pw-33h3-35xw
Atro CSRF Middleware Bypass (security.checkOrigin)
- Affected:
- <4.16.17
- Fixed in:
- 4.16.17
- Source:
- OSV source · Advisory
Latest release
Previous releases
4.0.2
6 Dec 2023
4.0.3
6 Dec 2023
4.0.0
5 Dec 2023
Release history
145 concrete releases tracked for this line.
| Version | Release date | Channel | Source |
|---|---|---|---|
| 4.0.1 | 5 Dec 2023 | stable | Source |
| 4.0.2 | 6 Dec 2023 | stable | Source |
| 4.0.3 | 6 Dec 2023 | stable | Source |
| 4.0.4 | 11 Dec 2023 | stable | Source |
| 4.0.5 | 14 Dec 2023 | stable | Source |
| 4.0.6 | 15 Dec 2023 | stable | Source |
| 4.0.7 | 20 Dec 2023 | stable | Source |
| 4.0.8 | 27 Dec 2023 | stable | Source |
| 4.0.9 | 2 Jan 2024 | stable | Source |
| 4.1.0 | 4 Jan 2024 | stable | Source |
| 4.1.1 | 5 Jan 2024 | stable | Source |
| 4.1.2 | 11 Jan 2024 | stable | Source |
| 4.1.3 | 16 Jan 2024 | stable | Source |
| 4.2.0 | 18 Jan 2024 | stable | Source |
| 4.2.1 | 18 Jan 2024 | stable | Source |
| 4.2.2 | 22 Jan 2024 | stable | Source |
| 4.2.3 | 22 Jan 2024 | stable | Source |
| 4.2.4 | 24 Jan 2024 | stable | Source |
| 4.2.5 | 26 Jan 2024 | stable | Source |
| 4.2.6 | 26 Jan 2024 | stable | Source |
| 4.2.7 | 30 Jan 2024 | stable | Source |
| 4.2.8 | 31 Jan 2024 | stable | Source |
| 4.3.0 | 1 Feb 2024 | stable | Source |
| 4.3.1 | 1 Feb 2024 | stable | Source |
| 4.0.0 | 5 Dec 2023 | stable | Source |
Release activity
- Total releases
- 145
- Last 30 days
- 0
- Last 90 days
- 0
- Avg. interval
- ~9 days
- Most recent
- 5 Dec 2023
Should I use this version?
Suitable for new deployments
Astro 4 is currently supported (standard support).
Version comparison
Compact comparison against the nearest relevant release lines.
Compatibility
Evidence-backed compatibility results involving Astro 4. Only combinations CompatHub can evaluate from upstream sources are listed.
Compatible targets
Sources
Where this information comes from.
Lifecycle sources
- Astro npm releasesfirst party · high confidence
Official source: https://www.npmjs.com/package/astro
Last verified 2 Sept 2026
- OSV.devfirst party
Official source: https://osv.dev
Verification time not recorded
- NVD (NIST)first party
Official source: https://nvd.nist.gov
Verification time not recorded
- CISA Known Exploited Vulnerabilitiesfirst party
Official source: https://www.cisa.gov/known-exploited-vulnerabilities-catalog
Verification time not recorded
Release sources
- Astro npm releasesfirst party · high confidence
Official source: https://www.npmjs.com/package/astro
Last verified 2 Sept 2026
Data coverage
Last checked = last successful upstream check. Latest source update = when upstream content last changed.
- Releases tracked
- 145
- Lifecycle periods
- 1
- EOL
- Not officially published
- Provenance records
- 2
- Data last checked
- 2 Sept 2026
- Latest source update
- 2 Sept 2026
EOL: Not officially published