# CVE-2026-73423: Astro composable astro/hono pipeline CSRF via origin check bypass

Source: https://junglewise.ai/threats/cve-2026-73423-astro-composable-astro-hono-pipeline-csrf-via-origin-check-bypass  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-08-12. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-73423 · Severity: medium · CVSS 4 · Published 2026-08-12

Astro is a web framework for building fast, content-focused websites. In its composable `astro/hono` pipeline, the security check that prevents cross-site form submissions (CSRF attacks) can be bypassed if middleware is omitted or ordered incorrectly, allowing an attacker to trigger state-changing actions (like form submissions or API calls) using a victim's authentication cookies without being able to read responses.

Technologies: [astro (npm)](https://junglewise.ai/threats/technologies/astro). Vendors: [npm](https://junglewise.ai/threats/vendors/npm).

## Quick answers

**Is CVE-2026-73423 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-73423 being exploited in the wild.

**How severe is CVE-2026-73423?** Medium severity, with a CVSS score of 4, published 12 August 2026.

**Which products and versions are affected?** astro (npm) SEMVER:introduced=7.0.0,fixed=7.0.6.

**Is there a fix for CVE-2026-73423?** Yes. astro (npm): upgrade to 7.0.6 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-73423 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-73423?** Check whether you run astro (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- astro (npm): upgrade to 7.0.6 or later

  ```sh
  npm install astro@7.0.6
  ```


## Technical details

The vulnerability is a cross-site request forgery (CWE-352) in Astro's composable `astro/hono` pipeline. The `security.checkOrigin` protection, which rejects cross-origin POST/PUT/PATCH/DELETE requests, is only applied within the `middleware()` primitive. When `actions()` or `pages()` primitives are mounted before `middleware()` or when `middleware()` is omitted entirely, these dispatch sinks bypass the origin check entirely. An attacker can trigger blind write-only CSRF attacks by crafting cross-origin form submissions that execute state-mutating handlers using the victim's credentials. The fix applies the origin check at each dispatch sink (`ActionHandler.handle` and `PagesHandler.handleWithErrorFallback`), making the check order-independent. Affected versions are Astro ≥7.0.0 using the composable pipeline with misordered or missing middleware; the classic `astro()` pipeline is unaffected because Astro automatically injects the check.

## Affected products

- Astro Astro >=7.0.0, <7.0.6

## Identifiers

- CVE-2026-73423
- GHSA-8mv7-9c27-98vc

## Timeline

- 2026-07-20: disclosed
- 2026-07-20: patched: Fix released in Astro 7.0.6

## References

- [https://github.com/withastro/astro/security/advisories/GHSA-8mv7-9c27-98vc](https://github.com/withastro/astro/security/advisories/GHSA-8mv7-9c27-98vc)
- [https://github.com/withastro/astro/pull/17250](https://github.com/withastro/astro/pull/17250)

## Related threats

- [Astro HTML injection in script and style element rendering](https://junglewise.ai/threats/cve-2026-114128-astro-is-a-web-framework-for-content-driven-websites-prior-to-7)
- [Astro CSS injection in View Transition animation values](https://junglewise.ai/threats/cve-2026-114127-astro-is-a-web-framework-for-content-driven-websites-from-7-1-0)
- [Astro remote code execution via AVIF image processing](https://junglewise.ai/threats/astro-remote-code-execution-via-avif-image-processing-6b99ffe8)
- [Astro authorization bypass in base path stripping](https://junglewise.ai/threats/cve-2026-84376-astro-authorization-bypass-in-base-path-stripping)
- [Astro reflected XSS via unescaped View Transition animation properties](https://junglewise.ai/threats/cve-2026-73422-astro-reflected-xss-via-unescaped-view-transition-animation)