CVE-2026-73423 Overview
CVE-2026-73423 is a Cross-Site Request Forgery (CSRF) vulnerability [CWE-352] affecting the Astro web framework versions 7.0.0 through 7.0.5. The flaw resides in the composable astro/hono pipeline, where the security.checkOrigin protection is installed only through the middleware() primitive. When developers mount actions() or pages() without or before middleware(), cross-origin form-encoded requests bypass the origin check. Attackers can trigger state-mutating action or endpoint handlers using a victim's cookies. The default non-composable astro() pipeline is not affected. The issue is fixed in version 7.0.6.
Critical Impact
Blind write-only CSRF against ActionHandler.handle and PagesHandler.handleWithErrorFallback allows attackers to invoke authenticated state-changing operations without reading the response.
Affected Products
- Astro framework versions 7.0.0 through 7.0.5 (composable astro/hono pipeline)
- Applications using actions() mounted before middleware() in the Hono composition
- Applications using pages() without middleware() for on-demand endpoints
Discovery Timeline
- 2026-08-12 - CVE-2026-73423 published to NVD
- 2026-08-12 - Last updated in NVD database
Technical Details for CVE-2026-73423
Vulnerability Analysis
Astro's composable pipeline for hono allows developers to compose request handling from discrete primitives: middleware(), actions(), and pages(). The origin-check protection controlled by security.checkOrigin was implemented as middleware only. This design assumed middleware() would execute before actions() and pages() in every composition. The examples/advanced-routing example and Cloudflare Hono documentation demonstrate mounting actions() before middleware(), which causes cross-origin form-encoded action requests to reach ActionHandler.handle without the origin check. Using pages() without middleware() similarly bypasses the check for on-demand endpoints and pages. Attackers can invoke any exposed Astro Action or on-demand endpoint handler using the victim's browser cookies.
Root Cause
The origin check was implemented as a middleware layer rather than being applied inside the action and page handlers themselves. The composable pipeline exposes primitives that can dispatch to user code independently of middleware execution. This decoupling breaks the security invariant that all state-mutating requests must pass through the origin verification step.
Attack Vector
An attacker hosts a malicious page that submits a form with application/x-www-form-urlencoded, multipart/form-data, or text/plain content type targeting a vulnerable Astro action endpoint. The victim's browser attaches session cookies to the cross-origin POST request. The action handler executes without verifying the request origin. The attacker cannot read the response due to Same-Origin Policy, but the state-changing action completes successfully.
import type { APIContext } from '../types/public/context.js';
+import {
+ createCrossOriginForbiddenResponse,
+ isForbiddenCrossOriginRequest,
+} from '../core/app/origin-check.js';
import { PipelineFeatures } from '../core/base-pipeline.js';
import type { FetchState } from '../core/fetch/fetch-state.js';
import { getActionContext, serializeActionResult } from './runtime/server.js';
Source: GitHub Commit 0b30b35 — The patch imports origin-check helpers directly into packages/astro/src/actions/handler.ts, applying the check inside the action handler regardless of pipeline order.
Detection Methods for CVE-2026-73423
Indicators of Compromise
- Cross-origin POST requests to Astro action endpoints with application/x-www-form-urlencoded, multipart/form-data, or text/plain content types.
- Requests to on-demand page endpoints where the Origin or Referer header does not match the application's own host.
- Unexpected state changes tied to authenticated user sessions without corresponding user navigation activity in access logs.
Detection Strategies
- Audit Astro project source for the composition order of middleware(), actions(), and pages() in hono pipeline definitions.
- Search codebases for astro/hono imports paired with actions() or pages() calls where middleware() is absent or ordered later.
- Review manifest.checkOrigin configuration to confirm the setting is enabled and enforced across all handlers.
Monitoring Recommendations
- Log and alert on POST requests to action routes with mismatched Origin and Host headers.
- Correlate authentication session activity with request origin to detect anomalous cross-site invocations.
- Instrument web application firewalls to reject form-encoded POSTs to /^_actions routes originating from untrusted hosts.
How to Mitigate CVE-2026-73423
Immediate Actions Required
- Upgrade Astro to version 7.0.6 or later, which applies the origin check inside ActionHandler.handle and PagesHandler.handleWithErrorFallback regardless of pipeline order.
- Inventory all deployments using the composable astro/hono pipeline and verify the middleware composition order.
- Enable security.checkOrigin in the Astro configuration if not already active.
Patch Information
The fix is available in Astro version 7.0.6, released via pull request #17250. The patch relocates origin verification from middleware into the action and page handlers themselves. Full details are available in the GitHub Security Advisory GHSA-8mv7-9c27-98vc and the Astro 7.0.6 release notes.
Workarounds
- Restructure the composable pipeline so middleware() is mounted before actions() and pages() in the Hono application.
- Switch to the default non-composable astro() pipeline, which is not affected by this vulnerability.
- Implement application-level CSRF tokens for state-mutating action endpoints as defense in depth.
# Upgrade Astro to the patched version
npm install astro@7.0.6
# Verify installed version
npm list astro
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
