CVE-2026-84376: Astro authorization bypass in base path stripping

CVE-2026-84376 · Severity: medium · CVSS 4 · Published 2026-09-02

Astro is a web framework used to build modern websites and applications. A flaw in how Astro handles configured base paths allows an unauthenticated attacker to bypass security checks in middleware that protect admin or sensitive routes. An attacker can craft a request to a slightly-modified URL (e.g., `/appX/admin` instead of `/app/admin`) that bypasses authorization checks while still reaching the protected route, potentially gaining unauthorized access to sensitive areas.

Technologies: astro (npm). Vendors: npm.

Quick answers

Is CVE-2026-84376 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-84376 being exploited in the wild.
How severe is CVE-2026-84376?
Medium severity, with a CVSS score of 4, published 2 September 2026.
Which products and versions are affected?
astro (npm) <= 7.2.3, SEMVER:introduced=0,fixed=7.2.4.
Is there a fix for CVE-2026-84376?
Yes. astro (npm): upgrade to 7.2.4 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-84376 attacked?
It is attacked over the network, in a web application.
Am I affected by CVE-2026-84376?
Check whether you run astro (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • astro (npm): upgrade to 7.2.4 or later
    npm install astro@7.2.4

Technical details

The vulnerability stems from a partial string comparison (CWE-187) in Astro's base path stripping logic. When a non-root base is configured (e.g., "/app"), the framework used a simple string-prefix check to strip the base from incoming request pathnames, without verifying that the match occurred on a path-segment boundary. This caused a request to /appX/admin to match the base prefix "/app", be internally routed as /admin, but still expose the original pathname /appX/admin to middleware. Applications following Astro's documented authentication guide (which uses context.url.pathname for route protection) could be bypassed when an attacker appends a single character to the base (e.g., /app2/, /app-/, /appX/). The flaw is fixed in version 7.2.4 by requiring the pathname to either exactly equal the base (without trailing slash) or be immediately followed by a forward slash, ensuring routing and middleware observe the same effective pathname. Network-accessible; no authentication or user interaction required.

Affected products

  • Astro astro <= 7.2.3

Identifiers

  • CVE-2026-84376
  • GHSA-376h-93r7-7g6f

Timeline

  • 2026-09-08: disclosed: Published to GitHub Advisory Database
  • 2026-09-02: patched: Fixed in astro 7.2.4; commit 05763a0

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.