CVE-2026-73424 reveals that Astro's Vercel adapter treated the /_isr endpoint as implicitly protected by Vercel's edge middleware, when in reality that endpoint operated entirely outside the middleware chain developers rely on to secure routes. The adapter accepted the x-vercel-isr header as authentication, but this header is client-supplied and trivially spoofable. Any request to /_isr with the correct cache key would return the rendered output of protected pages — dashboards, admin panels, behind-paywall content — without ever executing your edge middleware authentication logic.
The CVSS 6.5 score badly understates the real impact. ISR isn't used on trivial pages; it's deployed precisely on the high-value routes where developers invest in access controls. The vulnerability doesn't expose your homepage — it exposes the routes you explicitly tried to protect. Worse, developers using edge middleware to lock down routes had no indication anything was wrong. Their middleware was working perfectly — it just never ran against ISR requests.
The exposure window spans Astro versions 10.0.3 through 11.0.3, meaning deployments that cached ISR responses during that period may still be serving protected content to unauthorized requesters. The 11.0.3 patch adds authentication to the ISR handler, but you should verify your deployed version and audit which routes use ISR. Check your Vercel project for any /_isr paths in your routing config, confirm your adapter version is current, and treat any ISR-cached content on protected routes as potentially exposed during the vulnerable window.
This pattern — adapter code implicitly trusting platform-level access controls — has now appeared across multiple frameworks. When you deploy to a platform's edge layer, verify at the application layer that authentication runs on every code path, not just the ones your routing config makes obvious.