GHSA-376h-93r7-7g6f

Source

https://github.com/advisories/GHSA-376h-93r7-7g6f

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/09/GHSA-376h-93r7-7g6f/GHSA-376h-93r7-7g6f.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-376h-93r7-7g6f

Aliases

CVE-2026-84376

Published

2026-09-08T21:26:02Z

Modified

2026-09-08T21:30:04Z

Severity

6.3 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N CVSS Calculator

Summary

Astro: Authorization bypass from missing path-segment boundary check when stripping the configured base

Details

Summary

Astro stripped a configured base path from request pathnames using a string-prefix check that did not verify a path-segment boundary. With base: "/app", a request to /appX/admin was treated as being under the base and resolved internally to the /admin route, while middleware still observed the public pathname /appX/admin. Middleware that authorizes routes by inspecting context.url.pathname could therefore be bypassed.

Impact

An unauthenticated remote attacker can bypass pathname-based middleware authorization in applications that:

Configure a non-root base.
Protect base-prefixed routes in middleware using context.url.pathname.

Because routing and middleware resolved different effective pathnames, a request such as /appX/admin (or other single-character extensions like /app2/admin or /app-/admin) reached the protected /admin route without passing the middleware check that guards /app/admin. Astro's authentication guide demonstrates protecting routes in middleware via context.url.pathname, so this is a reasonable and expected pattern.

Affected versions

astro <= 7.2.3.

Patches

Fixed in astro 7.2.4. Base stripping now requires the pathname to equal the base without its trailing slash, or to be followed by a /, so a prefix that does not end on a path-segment boundary is no longer treated as being under the base. Routing and context.url.pathname now resolve the same pathname.

Workarounds

Upgrade to astro 7.2.4 or later. As a mitigation before upgrading, avoid relying solely on prefix checks of context.url.pathname for authorization, or reject requests whose pathname does not begin with the configured base followed by a path-segment boundary.

Credits

Reported by @Ryoga-exe.

Database specific

{
    "cwe_ids":  [
        "CWE-187"
    ],
    "github_reviewed":  true,
    "github_reviewed_at":  "2026-09-08T21:26:02Z",
    "nvd_published_at":  "2026-09-02T17:18:00Z",
    "severity":  "MODERATE"
}

References

Affected packages

npm / astro

Package

Name: astro; View open source insights on deps.dev
Purl: pkg:npm/astro

Affected ranges

Type: SEMVER
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

7.2.4

Database specific

last_known_affected_version_range

"<= 7.2.3"

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/09/GHSA-376h-93r7-7g6f/GHSA-376h-93r7-7g6f.json"