Is CVE-2026-73423 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-73423 being exploited in the wild.

How severe is CVE-2026-73423?

Medium severity, with a CVSS score of 4, published 12 August 2026.

Which products and versions are affected?

astro (npm) SEMVER:introduced=7.0.0,fixed=7.0.6.

Is there a fix for CVE-2026-73423?

Yes. astro (npm): upgrade to 7.0.6 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-73423 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-73423?

Check whether you run astro (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-73423: Astro composable astro/hono pipeline CSRF via origin check bypass

CVE-2026-73423 · Severity: medium · CVSS 4 · Published 2026-08-12

Astro is a web framework for building fast, content-focused websites. In its composable `astro/hono` pipeline, the security check that prevents cross-site form submissions (CSRF attacks) can be bypassed if middleware is omitted or ordered incorrectly, allowing an attacker to trigger state-changing actions (like form submissions or API calls) using a victim's authentication cookies without being able to read responses.

Technologies: astro (npm). Vendors: npm.

Quick answers

Is CVE-2026-73423 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-73423 being exploited in the wild.
How severe is CVE-2026-73423?: Medium severity, with a CVSS score of 4, published 12 August 2026.
Which products and versions are affected?: astro (npm) SEMVER:introduced=7.0.0,fixed=7.0.6.
Is there a fix for CVE-2026-73423?: Yes. astro (npm): upgrade to 7.0.6 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-73423 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-73423?: Check whether you run astro (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

astro (npm): upgrade to 7.0.6 or later
```
npm install astro@7.0.6
```

Technical details

The vulnerability is a cross-site request forgery (CWE-352) in Astro's composable `astro/hono` pipeline. The `security.checkOrigin` protection, which rejects cross-origin POST/PUT/PATCH/DELETE requests, is only applied within the `middleware()` primitive. When `actions()` or `pages()` primitives are mounted before `middleware()` or when `middleware()` is omitted entirely, these dispatch sinks bypass the origin check entirely. An attacker can trigger blind write-only CSRF attacks by crafting cross-origin form submissions that execute state-mutating handlers using the victim's credentials. The fix applies the origin check at each dispatch sink (`ActionHandler.handle` and `PagesHandler.handleWithErrorFallback`), making the check order-independent. Affected versions are Astro ≥7.0.0 using the composable pipeline with misordered or missing middleware; the classic `astro()` pipeline is unaffected because Astro automatically injects the check.

Affected products

Astro Astro >=7.0.0, <7.0.6

Identifiers

CVE-2026-73423
GHSA-8mv7-9c27-98vc

Timeline

2026-07-20: disclosed
2026-07-20: patched: Fix released in Astro 7.0.6

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.