CVE-2026-73423 Astro: composable `astro/hono` pipeline bypasses `security.checkOrigin` when `middleware()` is absent or misordered
Attackers can perform cross-site request forgery against Astro actions and pages if the security middleware is misordered or omitted, allowing state-changing requests.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2026-73423?
CVE-2026-73423 is a medium-severity vulnerability in withastro astro, published on 12 Aug 2026. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
Astro is a web framework for content-driven websites. From 7.0.0 until 7.0.6, the composable astro/hono pipeline installs security.checkOrigin only through the middleware() primitive, while actions() and pages() can dispatch to user code independently. Mounting actions() before middleware(), as in the examples/advanced-routing example and Cloudflare Hono documentation, allows cross-origin form-encoded action requests to execute before the origin check, and using pages() without middleware() drops the check for on-demand endpoints and pages. The flaw enables blind write-only cross-site request forgery using the victim's cookies against ActionHandler.handle and PagesHandler.handleWithErrorFallback when manifest.checkOrigin is enabled; the attacker can trigger a state-mutating action or endpoint handler but cannot read the cross-origin response. The default non-composable astro() pipeline is not affected. This issue is fixed in version 7.0.6.
Weakness: CWE-352
Which versions are affected by CVE-2026-73423?
2 open source packages ship an affected version, including astro.
| Package | Affected | Fixed in |
|---|---|---|
astro npm | From 7.0.0 | 7.0.6 |
astro npm | From 7.0.0 | 7.0.6 |
How do I fix CVE-2026-73423?
Upgrade astro to 7.0.6 or later.
Is CVE-2026-73423 being exploited?
There is no known exploitation of CVE-2026-73423 in the wild and no public exploit code.
Sources
Also known as GHSA-8mv7-9c27-98vc.