Vulnerability-Lookup

CVE-2026-73423 (GCVE-0-2026-73423)

Vulnerability from cvelistv5 – Published: 2026-08-12 20:35 – Updated: 2026-08-13 17:53

Title

Astro: composable `astro/hono` pipeline bypasses `security.checkOrigin` when `middleware()` is absent or misordered

Summary

Astro is a web framework for content-driven websites. From 7.0.0 until 7.0.6, the composable astro/hono pipeline installs security.checkOrigin only through the middleware() primitive, while actions() and pages() can dispatch to user code independently. Mounting actions() before middleware(), as in the examples/advanced-routing example and Cloudflare Hono documentation, allows cross-origin form-encoded action requests to execute before the origin check, and using pages() without middleware() drops the check for on-demand endpoints and pages. The flaw enables blind write-only cross-site request forgery using the victim's cookies against ActionHandler.handle and PagesHandler.handleWithErrorFallback when manifest.checkOrigin is enabled; the attacker can trigger a state-mutating action or endpoint handler but cannot read the cross-origin response. The default non-composable astro() pipeline is not affected. This issue is fixed in version 7.0.6.

Severity

5.1 (Medium)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N

SSVC

Exploitation: none Automatable: yes Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-08-13 17:49 UTC

CWE

CWE-352 - Cross-Site Request Forgery (CSRF)

Assigner

GitHub_M

References

4 references

URL	Tags
https://github.com/withastro/astro/security/advis…	x_refsource_CONFIRM
https://github.com/withastro/astro/pull/17250	x_refsource_MISC
https://github.com/withastro/astro/commit/0b30b35…	x_refsource_MISC
https://github.com/withastro/astro/releases/tag/a…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
withastro	astro	Affected: >= 7.0.0, < 7.0.6

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-73423",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-08-13T17:49:22.329880Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-08-13T17:53:25.469Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "astro",
          "vendor": "withastro",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 7.0.0, \u003c 7.0.6"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Astro is a web framework for content-driven websites. From 7.0.0 until 7.0.6, the composable astro/hono pipeline installs security.checkOrigin only through the middleware() primitive, while actions() and pages() can dispatch to user code independently. Mounting actions() before middleware(), as in the examples/advanced-routing example and Cloudflare Hono documentation, allows cross-origin form-encoded action requests to execute before the origin check, and using pages() without middleware() drops the check for on-demand endpoints and pages. The flaw enables blind write-only cross-site request forgery using the victim\u0027s cookies against ActionHandler.handle and PagesHandler.handleWithErrorFallback when manifest.checkOrigin is enabled; the attacker can trigger a state-mutating action or endpoint handler but cannot read the cross-origin response. The default non-composable astro() pipeline is not affected. This issue is fixed in version 7.0.6."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 5.1,
            "baseSeverity": "MEDIUM",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "LOW",
            "userInteraction": "ACTIVE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "NONE"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-352",
              "description": "CWE-352: Cross-Site Request Forgery (CSRF)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-12T20:35:32.181Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/withastro/astro/security/advisories/GHSA-8mv7-9c27-98vc",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/withastro/astro/security/advisories/GHSA-8mv7-9c27-98vc"
        },
        {
          "name": "https://github.com/withastro/astro/pull/17250",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/withastro/astro/pull/17250"
        },
        {
          "name": "https://github.com/withastro/astro/commit/0b30b35f864310bee8485c952d1877e82e2b9b1a",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/withastro/astro/commit/0b30b35f864310bee8485c952d1877e82e2b9b1a"
        },
        {
          "name": "https://github.com/withastro/astro/releases/tag/astro@7.0.6",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/withastro/astro/releases/tag/astro@7.0.6"
        }
      ],
      "source": {
        "advisory": "GHSA-8mv7-9c27-98vc",
        "discovery": "UNKNOWN"
      },
      "title": "Astro: composable `astro/hono` pipeline bypasses `security.checkOrigin` when `middleware()` is absent or misordered"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-73423",
    "datePublished": "2026-08-12T20:35:32.181Z",
    "dateReserved": "2026-08-12T14:32:11.795Z",
    "dateUpdated": "2026-08-13T17:53:25.469Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-73423",
      "date": "2026-08-15",
      "epss": "0.00182",
      "percentile": "0.08062"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-73423\",\"sourceIdentifier\":\"security-advisories@github.com\",\"published\":\"2026-08-12T21:17:41.340\",\"lastModified\":\"2026-08-13T18:18:17.463\",\"vulnStatus\":\"Received\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"Astro is a web framework for content-driven websites. From 7.0.0 until 7.0.6, the composable astro/hono pipeline installs security.checkOrigin only through the middleware() primitive, while actions() and pages() can dispatch to user code independently. Mounting actions() before middleware(), as in the examples/advanced-routing example and Cloudflare Hono documentation, allows cross-origin form-encoded action requests to execute before the origin check, and using pages() without middleware() drops the check for on-demand endpoints and pages. The flaw enables blind write-only cross-site request forgery using the victim\u0027s cookies against ActionHandler.handle and PagesHandler.handleWithErrorFallback when manifest.checkOrigin is enabled; the attacker can trigger a state-mutating action or endpoint handler but cannot read the cross-origin response. The default non-composable astro() pipeline is not affected. This issue is fixed in version 7.0.6.\"}],\"affected\":[{\"source\":\"security-advisories@github.com\",\"affectedData\":[{\"vendor\":\"withastro\",\"product\":\"astro\",\"versions\":[{\"version\":\"\u003e= 7.0.0, \u003c 7.0.6\",\"status\":\"affected\"}]}]}],\"metrics\":{\"cvssMetricV40\":[{\"source\":\"security-advisories@github.com\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"4.0\",\"vectorString\":\"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X\",\"baseScore\":5.1,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"attackRequirements\":\"NONE\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"ACTIVE\",\"vulnConfidentialityImpact\":\"NONE\",\"vulnIntegrityImpact\":\"NONE\",\"vulnAvailabilityImpact\":\"NONE\",\"subConfidentialityImpact\":\"NONE\",\"subIntegrityImpact\":\"LOW\",\"subAvailabilityImpact\":\"NONE\",\"exploitMaturity\":\"NOT_DEFINED\",\"confidentialityRequirement\":\"NOT_DEFINED\",\"integrityRequirement\":\"NOT_DEFINED\",\"availabilityRequirement\":\"NOT_DEFINED\",\"modifiedAttackVector\":\"NOT_DEFINED\",\"modifiedAttackComplexity\":\"NOT_DEFINED\",\"modifiedAttackRequirements\":\"NOT_DEFINED\",\"modifiedPrivilegesRequired\":\"NOT_DEFINED\",\"modifiedUserInteraction\":\"NOT_DEFINED\",\"modifiedVulnConfidentialityImpact\":\"NOT_DEFINED\",\"modifiedVulnIntegrityImpact\":\"NOT_DEFINED\",\"modifiedVulnAvailabilityImpact\":\"NOT_DEFINED\",\"modifiedSubConfidentialityImpact\":\"NOT_DEFINED\",\"modifiedSubIntegrityImpact\":\"NOT_DEFINED\",\"modifiedSubAvailabilityImpact\":\"NOT_DEFINED\",\"Safety\":\"NOT_DEFINED\",\"Automatable\":\"NOT_DEFINED\",\"Recovery\":\"NOT_DEFINED\",\"valueDensity\":\"NOT_DEFINED\",\"vulnerabilityResponseEffort\":\"NOT_DEFINED\",\"providerUrgency\":\"NOT_DEFINED\"}}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2026-08-13T17:49:22.329880Z\",\"id\":\"CVE-2026-73423\",\"options\":[{\"exploitation\":\"none\"},{\"automatable\":\"yes\"},{\"technicalImpact\":\"partial\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"security-advisories@github.com\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-352\"}]}],\"references\":[{\"url\":\"https://github.com/withastro/astro/commit/0b30b35f864310bee8485c952d1877e82e2b9b1a\",\"source\":\"security-advisories@github.com\"},{\"url\":\"https://github.com/withastro/astro/pull/17250\",\"source\":\"security-advisories@github.com\"},{\"url\":\"https://github.com/withastro/astro/releases/tag/astro@7.0.6\",\"source\":\"security-advisories@github.com\"},{\"url\":\"https://github.com/withastro/astro/security/advisories/GHSA-8mv7-9c27-98vc\",\"source\":\"security-advisories@github.com\"}]}}"
  }
}

GHSA-8MV7-9C27-98VC

Vulnerability from github – Published: 2026-07-20 23:26 – Updated: 2026-08-12 20:35

Summary

Astro: composable `astro/hono` pipeline bypasses `security.checkOrigin` when `middleware()` is absent or misordered

Details

Summary

In the composable astro/hono pipeline, the security.checkOrigin protection is only installed by the middleware() primitive. The actions() and pages() primitives each dispatch to user code independently, so a pipeline that mounts either primitive before (or without) middleware() will bypass the origin check for those requests.

Details

security.checkOrigin (default: true) is intended to reject cross-site POST/PUT/PATCH/DELETE form submissions. In the classic pipeline (astro() all-in-one), the check always runs because Astro injects a virtual middleware module even when the user has no src/middleware.ts. In the composable astro/hono pipeline, the user assembles primitives manually. The check is only installed inside middleware() — so:

Mounting actions() before middleware() allows cross-origin form-encoded action requests to execute before the gate runs. The examples/advanced-routing example and the Cloudflare hono docs shipped this order.
Omitting middleware() entirely (reasonable for apps with no custom middleware) silently drops checkOrigin protection for all on-demand endpoints and pages dispatched through pages().

The attack is a blind write-only CSRF: the attacker can trigger a state-mutating action or endpoint handler using the victim's cookies, but cannot read the cross-origin response body.

Affected versions

Astro >= 7.0.0 when using the composable astro/hono pipeline with either: - actions() mounted before middleware(), or - pages() used without middleware()

The default (non-composable) pipeline is not affected.

Fix

The origin check is now applied at each dispatch sink (ActionHandler.handle and PagesHandler.handleWithErrorFallback), gated on manifest.checkOrigin, using the same predicate as the middleware. The check is order-independent and a no-op when middleware() has already run.

Fix: https://github.com/withastro/astro/pull/17250

Workaround

Ensure middleware() is mounted before both actions() and pages() in the composable pipeline, and that it is always included even when no custom middleware logic is needed:

app.use(middleware());
app.use(actions());
app.use(pages());

Severity

5.1 (Medium)


                  
                    CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "npm",
        "name": "astro"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "7.0.0"
            },
            {
              "fixed": "7.0.6"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-73423"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-352"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-07-20T23:26:27Z",
    "nvd_published_at": null,
    "severity": "MODERATE"
  },
  "details": "## Summary\n\nIn the composable `astro/hono` pipeline, the `security.checkOrigin` protection is only installed by the `middleware()` primitive. The `actions()` and `pages()` primitives each dispatch to user code independently, so a pipeline that mounts either primitive before (or without) `middleware()` will bypass the origin check for those requests.\n\n## Details\n\n`security.checkOrigin` (default: `true`) is intended to reject cross-site `POST`/`PUT`/`PATCH`/`DELETE` form submissions. In the classic pipeline (`astro()` all-in-one), the check always runs because Astro injects a virtual middleware module even when the user has no `src/middleware.ts`. In the composable `astro/hono` pipeline, the user assembles primitives manually. The check is only installed inside `middleware()` \u2014 so:\n\n- Mounting `actions()` before `middleware()` allows cross-origin form-encoded action requests to execute before the gate runs. The `examples/advanced-routing` example and the Cloudflare `hono` docs shipped this order.\n- Omitting `middleware()` entirely (reasonable for apps with no custom middleware) silently drops `checkOrigin` protection for all on-demand endpoints and pages dispatched through `pages()`.\n\nThe attack is a blind write-only CSRF: the attacker can trigger a state-mutating action or endpoint handler using the victim\u0027s cookies, but cannot read the cross-origin response body.\n\n## Affected versions\n\nAstro `\u003e= 7.0.0` when using the composable `astro/hono` pipeline with either:\n- `actions()` mounted before `middleware()`, or\n- `pages()` used without `middleware()`\n\nThe default (non-composable) pipeline is not affected.\n\n## Fix\n\nThe origin check is now applied at each dispatch sink (`ActionHandler.handle` and `PagesHandler.handleWithErrorFallback`), gated on `manifest.checkOrigin`, using the same predicate as the middleware. The check is order-independent and a no-op when `middleware()` has already run.\n\nFix: https://github.com/withastro/astro/pull/17250\n\n## Workaround\n\nEnsure `middleware()` is mounted before both `actions()` and `pages()` in the composable pipeline, and that it is always included even when no custom middleware logic is needed:\n\n```ts\napp.use(middleware());\napp.use(actions());\napp.use(pages());\n```",
  "id": "GHSA-8mv7-9c27-98vc",
  "modified": "2026-08-12T20:35:36Z",
  "published": "2026-07-20T23:26:27Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/withastro/astro/security/advisories/GHSA-8mv7-9c27-98vc"
    },
    {
      "type": "WEB",
      "url": "https://github.com/withastro/astro/pull/17250"
    },
    {
      "type": "WEB",
      "url": "https://github.com/withastro/astro/commit/0b30b35f864310bee8485c952d1877e82e2b9b1a"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/withastro/astro"
    },
    {
      "type": "WEB",
      "url": "https://github.com/withastro/astro/releases/tag/astro@7.0.6"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N",
      "type": "CVSS_V4"
    }
  ],
  "summary": "Astro: composable `astro/hono` pipeline bypasses `security.checkOrigin` when `middleware()` is absent or misordered"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.

Action not permitted

CVE-2026-73423 (GCVE-0-2026-73423)

GHSA-8MV7-9C27-98VC

Summary

Details

Affected versions

Fix

Workaround

Tags

Sightings

Nomenclature