Astro CSRF protection bypass in astro/hono pipeline

Executive brief

A vulnerability in the Astro web framework's Hono integration could allow attackers to bypass security checks designed to prevent Cross-Site Request Forgery (CSRF). This occurs when specific components are used in an incorrect order or when certain security middleware is omitted, potentially allowing unauthorized actions to be performed on behalf of a logged-in user. While attackers cannot read sensitive data directly through this flaw, they could trigger state-changing operations like form submissions or data modifications.

Technical details

A Cross-Site Request Forgery (CSRF) vulnerability exists in the Astro 'astro/hono' composable pipeline. The 'security.checkOrigin' protection, which validates the Origin header for state-mutating requests (POST, PUT, PATCH, DELETE), is only initialized within the 'middleware()' primitive. If a developer mounts 'actions()' or 'pages()' before 'middleware()', or omits 'middleware()' entirely, the origin check is bypassed. This allows for blind, write-only CSRF attacks where an attacker can execute actions using a victim's session cookies. The issue was fixed in version 7.0.6 by moving the origin check to the dispatch sinks (ActionHandler and PagesHandler), making it independent of middleware ordering.

Affected products

• withastro Astro >= 7.0.0, < 7.0.6

Timeline

• 2026-07-17: disclosed: Initial report to vendor
• 2026-07-20: advisory: GitHub Advisory published
• 2026-07-20: patched: Fix released in version 7.0.6

References

• https://api.github.com/users/jlgore
• https://github.com/jlgore
• https://api.github.com/users/jlgore/gists%7B/gist_id%7D
• https://api.github.com/users/jlgore/repos
• https://avatars.githubusercontent.com/u/8580514?v=4
• https://api.github.com/users/jlgore/events%7B/privacy%7D