Astro Framework CSRF via Missing Origin Check in Actions and Pages

Publication date: 2026-08-12

Last updated on: 2026-08-12

Assigner: GitHub, Inc.

Description

Astro is a web framework for content-driven websites. From 7.0.0 until 7.0.6, the composable astro/hono pipeline installs security.checkOrigin only through the middleware() primitive, while actions() and pages() can dispatch to user code independently. Mounting actions() before middleware(), as in the examples/advanced-routing example and Cloudflare Hono documentation, allows cross-origin form-encoded action requests to execute before the origin check, and using pages() without middleware() drops the check for on-demand endpoints and pages. The flaw enables blind write-only cross-site request forgery using the victim's cookies against ActionHandler.handle and PagesHandler.handleWithErrorFallback when manifest.checkOrigin is enabled; the attacker can trigger a state-mutating action or endpoint handler but cannot read the cross-origin response. The default non-composable astro() pipeline is not affected. This issue is fixed in version 7.0.6.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-12

Last Modified

2026-08-12

Generated

2026-08-13

AI Q&A

2026-08-13

EPSS Evaluated

N/A

NVD

CVE-2026-73423

Affected Vendors & Products

Vendor	Product	Version / Range
astro	astro	7.0.6

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-352	The web application does not, or cannot, sufficiently verify whether a request was intentionally provided by the user who sent the request, which could have originated from an unauthorized actor.

Attack-Flow Graph

Executive Summary

This vulnerability affects the Astro web framework versions 7.0.0 to 7.0.5. It involves a flaw in the composable astro/hono pipeline where security checks for cross-origin requests are not properly enforced. Specifically, actions() and pages() can bypass the origin check if middleware() is not mounted first, allowing cross-site request forgery (CSRF) attacks that can modify state using the victim's cookies.

Impact Analysis

An attacker could exploit this to perform blind write-only CSRF attacks against your Astro application. This means they can trigger actions or endpoint handlers that modify data using your authenticated session cookies, but they cannot read the response. This could lead to unauthorized changes in your application's state.

Mitigation Strategies

Upgrade Astro to version 7.0.6 or later to address the vulnerability. Ensure the composable astro/hono pipeline is configured correctly by placing middleware() before actions() and pages() to enforce origin checks. Review and update any custom routing configurations to avoid bypassing security checks.

Hi! I’m here to help you understand CVE-2026-73423. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70