PT-2026-66643

Summary In the composable astro/hono pipeline, the security.checkOrigin protection is only installed by the middleware primitive. The actions and pages primitives each dispatch to user code independently, so a pipeline that mounts either primitive before or without middleware will bypass the orig...

CVE-2024-56140: Cross-Site Request Forgery (CSRF)

Astro is a web framework for content-driven websites. In affected versions a bug in Astro’s CSRF-protection middleware allows requests to bypass CSRF checks. When the security.checkOrigin configuration option is set to true, Astro middleware will perform a CSRF check. However, a vulnerability...

PT-2024-36723

Name of the Vulnerable Software and Affected Versions Astro versions prior to 4.16.17 Description A bug in Astro’s CSRF-protection middleware allows requests to bypass CSRF checks. When the security.checkOrigin configuration option is set to true, Astro middleware will perform a CSRF check...