CVE-2026-84376 Overview
CVE-2026-84376 is an authorization bypass vulnerability in Astro, a web framework for content-driven websites. Versions prior to 7.2.4 strip a configured non-root base path from request pathnames using a string-prefix check that does not verify a path-segment boundary. An unauthenticated remote attacker can craft a request whose pathname begins with the configured base string but is not actually within that base segment. Astro routes the request internally to the protected route while middleware observes the original, unstripped pathname in context.url.pathname. Applications that authorize base-prefixed routes by inspecting context.url.pathname fail to enforce access control. The issue is fixed in version 7.2.4.
Critical Impact
Unauthenticated attackers can bypass pathname-based middleware authorization and reach protected routes in Astro applications configured with a non-root base path.
Affected Products
- Astro web framework versions prior to 7.2.4
- Astro applications configured with a non-root base option
- Astro deployments relying on middleware for pathname-based authorization
Discovery Timeline
- 2026-09-02 - CVE-2026-84376 published to NVD
- 2026-09-02 - Last updated in NVD database
Technical Details for CVE-2026-84376
Vulnerability Analysis
The vulnerability is an authorization bypass caused by improper handling of a leading substring [CWE-187]. Astro allows applications to configure a base path such as /app. Incoming requests are expected to be prefixed with this base, which the framework strips before routing to the internal handler. The stripping logic performed a plain string-prefix check without confirming that the character following the base was a path separator or end-of-string.
Root Cause
With a configured base of /app, a request to /appX/admin satisfies the naive startsWith('/app') check. Astro strips /app from the pathname and routes the request to /admin internally. However, middleware observes the untouched value /appX/admin in context.url.pathname. Any authorization logic that compares context.url.pathname against expected base-prefixed routes (for example, /app/admin) fails to match and skips access checks. The protected handler still runs.
Attack Vector
An unauthenticated remote attacker sends an HTTP request whose path begins with the configured base value followed by additional characters within the same segment. Middleware sees a foreign path and permits the request, while Astro's internal router resolves it to a protected route. No authentication, elevated privileges, or user interaction is required.
// Security patch in packages/astro/src/core/app/base.ts
import {
- collapseDuplicateLeadingSlashes,
prependForwardSlash,
removeTrailingForwardSlash,
+ stripRequestBase,
} from '@astrojs/internal-helpers/path';
import { matchPattern } from '@astrojs/internal-helpers/remote';
import { computePathnameFromDomain } from '../i18n/domain.js';
Source: GitHub Commit 05763a0
The patch replaces the prefix-stripping logic with a new stripRequestBase helper that respects path-segment boundaries, ensuring /appX/... is no longer treated as being within the /app base.
Detection Methods for CVE-2026-84376
Indicators of Compromise
- Access log entries containing pathnames that begin with the configured base string followed immediately by non-slash characters (for example, /appX/admin when base is /app).
- Successful HTTP responses on protected routes without preceding authentication events in application logs.
- Requests reaching admin or protected handlers where middleware audit logs report a non-matching pathname.
Detection Strategies
- Review web server and application logs for request pathnames that partially match the configured base but include extra characters before the next /.
- Correlate middleware authorization decisions with the internal route handler that ultimately served the response.
- Search for anomalous 200-series responses on /admin or other privileged endpoints not preceded by session or token validation.
Monitoring Recommendations
- Emit structured logs from middleware that include both context.url.pathname and the resolved internal route to expose mismatches.
- Alert on any request served by a protected handler when the observed pathname does not exactly match an authorized base-prefixed pattern.
- Add regression tests that assert requests to <base>X/<route> return 404 rather than reaching protected handlers.
How to Mitigate CVE-2026-84376
Immediate Actions Required
- Upgrade Astro to version 7.2.4 or later, which applies path-segment-aware base stripping.
- Audit middleware code that authorizes based on context.url.pathname and inventory routes protected by base-prefix matching.
- Review recent access logs for exploitation attempts using crafted pathnames that shadow the configured base.
Patch Information
The fix is available in Astro 7.2.4. See the GitHub Security Advisory GHSA-376h-93r7-7g6f, the GitHub Release astro@7.2.4, and the corresponding Pull Request #17701. The patch introduces stripRequestBase from @astrojs/internal-helpers/path and replaces the prior prefix-only logic.
Workarounds
- Change middleware authorization to match on the internally resolved route rather than context.url.pathname.
- Add explicit segment-boundary validation before treating a request as belonging to the configured base (require the character after the base to be / or end-of-string).
- Restrict access to protected routes at an upstream layer such as a reverse proxy that enforces exact base-prefix matching.
# Upgrade Astro to the patched release
npm install astro@7.2.4
# Or with pnpm / yarn
pnpm add astro@7.2.4
yarn add astro@7.2.4
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
