CVE-2026-84376 Astro: Authorization bypass from missing path-segment boundary check when stripping the configured base
Attackers can bypass middleware authorization in Astro apps using a non-root base path by exploiting a missing path-segment boundary check.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-84376?
CVE-2026-84376 is a medium-severity authentication bypass vulnerability in withastro astro, published on 2 Sep 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Astro is a web framework for content-driven websites. Prior to 7.2.4, Astro stripped a configured non-root base path from request pathnames using a string-prefix check without verifying a path-segment boundary. With base "/app", a request to "/appX/admin" resolved internally to the protected "/admin" route while middleware observed "/appX/admin" in context.url.pathname. In applications that authorize base-prefixed routes by inspecting context.url.pathname, an unauthenticated remote attacker could bypass pathname-based middleware authorization and reach protected routes. This issue is fixed in version 7.2.4.
Weakness: CWE-187
Which versions are affected by CVE-2026-84376?
2 open source packages ship an affected version, including astro.
| Package | Affected | Fixed in |
|---|---|---|
astro npm | All versions | 7.2.4 |
astro npm | All versions | 7.2.4 |
How do I fix CVE-2026-84376?
Upgrade astro to 7.2.4 or later.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2026-84376 being exploited?
There is no known exploitation of CVE-2026-84376 in the wild and no public exploit code.
Sources
Also known as CLSA-2026-1790175733, CLSA-2026-1790176521, CLSA-2026-1790185871, CLSA-2026-1790457826, CLSA-2026-1790459384, CLSA-2026-1792160952 and 17 more.