CVE-2026-84376

Name of the Vulnerable Software and Affected Versions Astro versions prior to 7.2.4

Description Astro improperly handles the removal of a configured non-root base path from request pathnames by using a string-prefix check that fails to verify path-segment boundaries. This allows an unauthenticated remote attacker to bypass middleware authorization that relies on inspecting context.url.pathname. For example, if the base path is set to "/app", a request to "/appX/admin" may be internally resolved to the protected "/admin" route while the middleware still sees the original path, granting unauthorized access to protected routes.

Recommendations Update to version 7.2.4.