CVE-2026-73423

A flaw was found in Astro. The composable astro/hono pipeline can bypass origin checks, which are designed to prevent unauthorized cross-site requests. This occurs because the security.checkOrigin mechanism is not consistently applied when middleware is absent or misordered in the pipeline. A...

CVE-2026-73423: Cross-Site Request Forgery (CSRF)

Astro is a web framework for content-driven websites. From 7.0.0 until 7.0.6, the composable astro/hono pipeline installs security.checkOrigin only through the middleware primitive, while actions and pages can dispatch to user code independently. Mounting actions before middleware, as in the...

Astro: composable `astro/hono` pipeline bypasses `security.checkOrigin` when `middleware()` is absent or misordered

Summary In the composable astro/hono pipeline, the security.checkOrigin protection is only installed by the middleware primitive. The actions and pages primitives each dispatch to user code independently, so a pipeline that mounts either primitive before or without middleware will bypass the orig...

GHSA-8MV7-9C27-98VC Astro: composable `astro/hono` pipeline bypasses `security.checkOrigin` when `middleware()` is absent or misordered

Summary In the composable astro/hono pipeline, the security.checkOrigin protection is only installed by the middleware primitive. The actions and pages primitives each dispatch to user code independently, so a pipeline that mounts either primitive before or without middleware will bypass the orig...