CVE-2026-73423

Name of the Vulnerable Software and Affected Versions Astro versions 7.0.0 through 7.0.5

Description The composable astro/hono pipeline installs security.checkOrigin exclusively through the middleware() primitive, whereas actions() and pages() can dispatch to user code independently. If actions() are mounted before middleware(), cross-origin form-encoded action requests can execute before the origin check. Additionally, using pages() without middleware() removes the check for on-demand endpoints and pages. This allows blind write-only cross-site request forgery (CSRF)—a type of attack where an unauthorized command is transmitted from a user that the web application trusts—using the victim's cookies against ActionHandler.handle and PagesHandler.handleWithErrorFallback when manifest.checkOrigin is enabled. An attacker can trigger a state-mutating action or endpoint handler but cannot read the cross-origin response.

Recommendations Update to version 7.0.6.