CVE-2026-84376
Received Received - Intake

Path Traversal in Astro Framework

Publication date: 2026-09-02

Last updated on: 2026-09-02

Assigner: GitHub, Inc.

Description
Astro is a web framework for content-driven websites. Prior to 7.2.4, Astro stripped a configured non-root base path from request pathnames using a string-prefix check without verifying a path-segment boundary. With base "/app", a request to "/appX/admin" resolved internally to the protected "/admin" route while middleware observed "/appX/admin" in context.url.pathname. In applications that authorize base-prefixed routes by inspecting context.url.pathname, an unauthenticated remote attacker could bypass pathname-based middleware authorization and reach protected routes. This issue is fixed in version 7.2.4.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-02
Last Modified
2026-09-02
Generated
2026-09-02
AI Q&A
2026-09-02
EPSS Evaluated
N/A
NVD
CVE-2026-84376
EUVD
EUVD-2026-70213

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
astro astro 7.2.4
withastro astro 7.2.4

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-187 The product performs a comparison that only examines a portion of a factor before determining whether there is a match, such as a substring, leading to resultant weaknesses.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in Astro versions before 7.2.4 allows an attacker to bypass pathname-based authorization checks by crafting requests with single-character extensions to the base path. For example, with a base path set to '/app', a request to '/appX/admin' would be incorrectly treated as '/admin' by routing while middleware sees '/appX/admin', bypassing security checks that rely on the observed pathname.

Detection Guidance

To detect this vulnerability, check if your Astro application uses a non-root base path and relies on context.url.pathname for authorization. Test with requests like /appX/admin, /app2/admin, or /app-/admin to see if protected routes are accessible without proper authentication. Ensure your Astro version is 7.2.4 or later.

Impact Analysis

If you use Astro with a non-root base path and rely on middleware to authorize routes based on context.url.pathname, attackers could access protected routes without proper authentication. This could lead to unauthorized access to sensitive data or functionality, depending on the application's protected routes.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, which may violate compliance requirements for data protection standards like GDPR or HIPAA. Unauthorized access to protected routes could expose personal or health information, resulting in legal and regulatory penalties.

Mitigation Strategies

Upgrade Astro to version 7.2.4 or later to patch the vulnerability. As a temporary measure, avoid relying solely on prefix checks of context.url.pathname for authorization. Reject requests where the pathname does not begin with the configured base followed by a path-segment boundary.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-84376. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart