CVE-2026-84376: Astro Package Authorization Bypass Due to Path-Segment Boundary Check Failure
Summary
CVE-2026-84376: Astro: Authorization bypass from missing path-segment boundary check when stripping the configured base. Affects astro versions < 7.2.4. Fixed in 7.2.4. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Astro is a modern static site generator that allows developers to build fast websites using their favorite frameworks. It provides a flexible routing system and middleware for handling requests. However, a recent vulnerability has been identified that affects its authorization mechanisms when configured with a non-root base path.
Vulnerability Detail
The vulnerability arises from Astro's method of stripping a configured base path from request pathnames using a string-prefix check that fails to verify path-segment boundaries. For instance, with a base path of '/app', a request to '/appX/admin' is incorrectly treated as being under the base, allowing unauthorized access to protected routes. This issue can lead to unauthorized users accessing sensitive areas of an application, as middleware that relies on checking the public pathname can be bypassed.
How To Fix
Latest published version: 7.4.2 as of 23 Oct 2026
npm install astro@7.4.2Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
7.2.4
This is the first release that contains the fix.
npm install astro@7.2.4Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround before upgrading, avoid relying solely on prefix checks of context.url.pathname for authorization. Instead, implement checks that ensure the pathname begins with the configured base followed by a path-segment boundary. For example, you can add a check like this in your middleware: if (!
context.url.pathname.startsWith('/app/') && context.url.pathname !== '/app') { rejectRequest();
}
Conclusion
The Astro package has a vulnerability (CVE-2026-84376) that allows for authorization bypass due to improper path-segment boundary checks. It is crucial for users to upgrade to version 7.2.4 or later to mitigate this risk. Implementing additional checks in middleware can serve as a temporary workaround.
See every vulnerability recorded for astro →
FAQ
CVE-2026-84376 is a vulnerability in the Astro package that allows unauthorized access to protected routes due to a failure in checking path-segment boundaries.
If your application uses Astro with a non-root base path and relies on pathname-based middleware for authorization, this vulnerability could allow unauthorized users to access restricted areas.
Astro versions 7.2.3 and earlier are affected by this vulnerability.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The CVSS score of this vulnerability is 6.3, indicating a moderate severity level.
References
Related vulnerabilities
Recent vulnerabilities recorded for astro.
