AIKIDO-2026-750327

TL;DR

The @astrojs/vercel serverless adapter exposes an internal _isr function that rewrites the request path from the client-supplied x_astro_path query parameter without any authentication when ISR is enabled. Because edge access controls and split-deployment middleware only ever evaluate the /_isr path, an unauthenticated attacker can request /_isr?x_astro_path=/protected to make the origin freshly render and return any GET route that is protected only at the edge. A prior fix required a trusted secret for path overrides, but a later change that prevented ISR 404s reintroduced the query-parameter source guarded only by a non-security header. The patch stops trusting the client-supplied path for ISR path overrides.