Skip to content
Log inStart free trial

GHSA-376h-93r7-7g6f CVE-2026-84376

Astro: Authorization bypass from missing path-segment boundary check when stripping the configured base

Medium npm
Severity
6.3 / 10
Medium · CVSS 4.0
Exploit chance (EPSS)
0.71%
Chance of exploitation in the next 30 days. Higher than 53.43% of scored vulnerabilities.
Known exploited
No
Not in CISA's catalog
Weakness
CWE-187 Partial String Comparison
Fix
7.2.4
Upgrade astro to this version or later

Description

Summary

Astro stripped a configured base path from request pathnames using a string-prefix check that did not verify a path-segment boundary. With base: "/app", a request to /appX/admin was treated as being under the base and resolved internally to the /admin route, while middleware still observed the public pathname /appX/admin. Middleware that authorizes routes by inspecting context.url.pathname could therefore be bypassed.

Impact

An unauthenticated remote attacker can bypass pathname-based middleware authorization in applications that:

  • Configure a non-root base.
  • Protect base-prefixed routes in middleware using context.url.pathname.

Because routing and middleware resolved different effective pathnames, a request such as /appX/admin (or other single-character extensions like /app2/admin or /app-/admin) reached the protected /admin route without passing the middleware check that guards /app/admin. Astro's authentication guide demonstrates protecting routes in middleware via context.url.pathname, so this is a reasonable and expected pattern.

Affected versions

astro <= 7.2.3.

Patches

Fixed in astro 7.2.4. Base stripping now requires the pathname to equal the base without its trailing slash, or to be followed by a /, so a prefix that does not end on a path-segment boundary is no longer treated as being under the base. Routing and context.url.pathname now resolve the same pathname.

Workarounds

Upgrade to astro 7.2.4 or later. As a mitigation before upgrading, avoid relying solely on prefix checks of context.url.pathname for authorization, or reject requests whose pathname does not begin with the configured base followed by a path-segment boundary.

Credits

Reported by @Ryoga-exe.

Affected versions

npm

PackageVulnerableFixed in
astro
<= 7.2.3
 No fix yet
astro
< 7.2.4
7.2.4

How to fix

Move to the fixed version or later with your package manager, update the lockfile, and run your tests. If the package only arrives through another dependency, upgrade that dependency first. If none of its releases pulls a fixed version yet, force the version with your package manager's override.

astro npm → 7.2.4

npm
npm install astro@7.2.4
yarn
yarn add astro@7.2.4
pnpm
pnpm add astro@7.2.4

Severity breakdown

CVSS 4.0 6.3

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

Attack vector
Network
Attack complexity
Low
Attack requirements
Present
Privileges required
None
User interaction
None
Confidentiality (vulnerable system)
Low
Integrity (vulnerable system)
Low
Availability (vulnerable system)
None
Confidentiality (subsequent systems)
None
Integrity (subsequent systems)
None
Availability (subsequent systems)
None

Weakness

CWE-187: Partial String Comparison

The product performs a comparison that only examines a portion of a factor before determining whether there is a match, such as a substring, leading to resultant weaknesses.

How to prevent it
  • Testing: Thoroughly test the comparison scheme before deploying code into production. Perform positive testing as well as negative testing.

References

Advisories

Fixes and patches

Packages

Other links

Timeline

  1. Published
  2. Last updated by the source
  3. Latest EPSS score
AdvisorySeverityWhy it's related
GHSA-98hj-9722-w3j8
Astro: Reflected/Stored XSS via unescaped <script>/<style> tag content in JSX/MDX rendering
Medium Also affects astro
GHSA-mpr7-6m5w-76rw
Astro: Arbitrary CSS injection in Astro View Transitions
Low Also affects astro
GHSA-26w7-cxv4-gfx2
Astro: Remote code execution through AVIF image optimization
Critical Also affects astro
GHSA-8mv7-9c27-98vc
Astro: composable `astro/hono` pipeline bypasses `security.checkOrigin` when `middleware()` is absent or misordered
Medium Also affects astro
GHSA-f48w-9m4c-m7f5
Astro: XSS via unescaped spread attribute names in renderHTMLElement (incomplete fix for CVE-2026-54298)
Medium Also affects astro
GHSA-7pw4-f3q4-r2p2
Astro: Cross-site scripting via unescaped transition:* directive values on hydrated islands
Low Also affects astro
GHSA-4g3v-8h47-v7g6
Astro: Reflected XSS via unescaped View Transition animation properties
Medium Also affects astro
GHSA-vj59-8hwv-xxmv
Astro: Authorization Bypass via Decode Iteration Limit and Rewrite Path Canonicalization Mismatch
High Also affects astro

Credits: Ryoga-exe

Is this in your code?

MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.

Check your repos with MergeHarbor