Executive brief
Astro is a web framework for building fast, content-focused websites. In its composable `astro/hono` pipeline, the security check that prevents cross-site form submissions (CSRF attacks) can be bypassed if middleware is omitted or ordered incorrectly, allowing an attacker to trigger state-changing actions (like form submissions or API calls) using a victim's authentication cookies without being able to read responses.
Technical details
The vulnerability is a cross-site request forgery (CWE-352) in Astro's composable `astro/hono` pipeline. The `security.checkOrigin` protection, which rejects cross-origin POST/PUT/PATCH/DELETE requests, is only applied within the `middleware()` primitive. When `actions()` or `pages()` primitives are mounted before `middleware()` or when `middleware()` is omitted entirely, these dispatch sinks bypass the origin check entirely. An attacker can trigger blind write-only CSRF attacks by crafting cross-origin form submissions that execute state-mutating handlers using the victim's credentials. The fix applies the origin check at each dispatch sink (`ActionHandler.handle` and `PagesHandler.handleWithErrorFallback`), making the check order-independent. Affected versions are Astro ≥7.0.0 using the composable pipeline with misordered or missing middleware; the classic `astro()` pipeline is unaffected because Astro automatically injects the check.
Affected products
- Astro Astro >=7.0.0, <7.0.6
Timeline
- 2026-07-20: disclosed
- 2026-07-20: patched: Fix released in Astro 7.0.6