Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
Astro packages risk remote attacks, update required
published 3 months ago
Summary
The Astro JavaScript packages (db, rss, studio, telemetry, underscore-redirects) contain two security weaknesses that could let an attacker interfere with your site or data. Updating to version 4.16.19-tuxcare.2 fixes the problems. Apply the update as soon as possible to keep your site safe.
What to do
- Update astrojs @astrojs/db to version 4.16.19-tuxcare.2.
- Update astrojs @astrojs/rss to version 4.16.19-tuxcare.2.
- Update astrojs @astrojs/studio to version 4.16.19-tuxcare.2.
- Update astrojs @astrojs/telemetry to version 4.16.19-tuxcare.2.
- Update astrojs @astrojs/underscore-redirects to version 4.16.19-tuxcare.2.
- Update astrojs @astrojs/upgrade to version 4.16.19-tuxcare.2.
- Update GitHub Actions astro to version 4.16.19-tuxcare.2.
- Update GitHub Actions create-astro to version 4.16.19-tuxcare.2.
- Update astro to version 4.16.19-tuxcare.2.
- Update create-astro to version 4.16.19-tuxcare.2.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| TuxCare:npm | astrojs | @astrojs/db |
< 4.16.19-tuxcare.2 Fix: upgrade to 4.16.19-tuxcare.2
|
| TuxCare:npm | astrojs | @astrojs/rss |
< 4.16.19-tuxcare.2 Fix: upgrade to 4.16.19-tuxcare.2
|
| TuxCare:npm | astrojs | @astrojs/studio |
< 4.16.19-tuxcare.2 Fix: upgrade to 4.16.19-tuxcare.2
|
| TuxCare:npm | astrojs | @astrojs/telemetry |
< 4.16.19-tuxcare.2 Fix: upgrade to 4.16.19-tuxcare.2
|
| TuxCare:npm | astrojs | @astrojs/underscore-redirects |
< 4.16.19-tuxcare.2 Fix: upgrade to 4.16.19-tuxcare.2
|
| TuxCare:npm | astrojs | @astrojs/upgrade |
< 4.16.19-tuxcare.2 Fix: upgrade to 4.16.19-tuxcare.2
|
| TuxCare:npm | GitHub Actions | astro |
< 4.16.19-tuxcare.2 Fix: upgrade to 4.16.19-tuxcare.2
|
| TuxCare:npm | GitHub Actions | create-astro |
< 4.16.19-tuxcare.2 Fix: upgrade to 4.16.19-tuxcare.2
|
| TuxCare:npm | – | astro |
< 4.16.19-tuxcare.2 >= 4.16.19-tuxcare.0, < 4.16.19-tuxcare.2 Fix: upgrade to 4.16.19-tuxcare.2
|
| TuxCare:npm | – | create-astro |
< 4.16.19-tuxcare.2 Fix: upgrade to 4.16.19-tuxcare.2
|
Original advisory text
TuxCare security update for astro (2 CVEs)
TuxCare rebuilt astro to address 2 CVEs. Fixed in 4.16.19-tuxcare.2.
Timeline
Published4 Aug 2026
Updated30 Oct 2026
First seen13 Oct 2026
Sources
CLSA-2026-1783904627 · OSV
Track software like this
Free during beta