# CVE-2026-84376: Astro authorization bypass in base path stripping

Source: https://junglewise.ai/threats/cve-2026-84376-astro-authorization-bypass-in-base-path-stripping  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-02. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-84376 · Severity: medium · CVSS 4 · Published 2026-09-02

Astro is a web framework used to build modern websites and applications. A flaw in how Astro handles configured base paths allows an unauthenticated attacker to bypass security checks in middleware that protect admin or sensitive routes. An attacker can craft a request to a slightly-modified URL (e.g., `/appX/admin` instead of `/app/admin`) that bypasses authorization checks while still reaching the protected route, potentially gaining unauthorized access to sensitive areas.

Technologies: [astro (npm)](https://junglewise.ai/threats/technologies/astro). Vendors: [npm](https://junglewise.ai/threats/vendors/npm).

## Quick answers

**Is CVE-2026-84376 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-84376 being exploited in the wild.

**How severe is CVE-2026-84376?** Medium severity, with a CVSS score of 4, published 2 September 2026.

**Which products and versions are affected?** astro (npm) <= 7.2.3, SEMVER:introduced=0,fixed=7.2.4.

**Is there a fix for CVE-2026-84376?** Yes. astro (npm): upgrade to 7.2.4 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-84376 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-84376?** Check whether you run astro (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- astro (npm): upgrade to 7.2.4 or later

  ```sh
  npm install astro@7.2.4
  ```


## Technical details

The vulnerability stems from a partial string comparison (CWE-187) in Astro's base path stripping logic. When a non-root base is configured (e.g., "/app"), the framework used a simple string-prefix check to strip the base from incoming request pathnames, without verifying that the match occurred on a path-segment boundary. This caused a request to /appX/admin to match the base prefix "/app", be internally routed as /admin, but still expose the original pathname /appX/admin to middleware. Applications following Astro's documented authentication guide (which uses context.url.pathname for route protection) could be bypassed when an attacker appends a single character to the base (e.g., /app2/, /app-/, /appX/). The flaw is fixed in version 7.2.4 by requiring the pathname to either exactly equal the base (without trailing slash) or be immediately followed by a forward slash, ensuring routing and middleware observe the same effective pathname. Network-accessible; no authentication or user interaction required.

## Affected products

- Astro astro <= 7.2.3

## Identifiers

- CVE-2026-84376
- GHSA-376h-93r7-7g6f

## Timeline

- 2026-09-08: disclosed: Published to GitHub Advisory Database
- 2026-09-02: patched: Fixed in astro 7.2.4; commit 05763a0

## References

- [https://api.github.com/users/Ryoga-exe](https://api.github.com/users/Ryoga-exe)
- [https://github.com/Ryoga-exe](https://github.com/Ryoga-exe)
- [https://api.github.com/users/Ryoga-exe/gists%7B/gist_id%7D](https://api.github.com/users/Ryoga-exe/gists%7B/gist_id%7D)
- [https://api.github.com/users/Ryoga-exe/repos](https://api.github.com/users/Ryoga-exe/repos)
- [https://avatars.githubusercontent.com/u/49950206?v=4](https://avatars.githubusercontent.com/u/49950206?v=4)
- [https://api.github.com/users/Ryoga-exe/events%7B/privacy%7D](https://api.github.com/users/Ryoga-exe/events%7B/privacy%7D)

## Related threats

- [Astro HTML injection in script and style element rendering](https://junglewise.ai/threats/cve-2026-114128-astro-is-a-web-framework-for-content-driven-websites-prior-to-7)
- [Astro CSS injection in View Transition animation values](https://junglewise.ai/threats/cve-2026-114127-astro-is-a-web-framework-for-content-driven-websites-from-7-1-0)
- [Astro remote code execution via AVIF image processing](https://junglewise.ai/threats/astro-remote-code-execution-via-avif-image-processing-6b99ffe8)
- [Astro composable astro/hono pipeline CSRF via origin check bypass](https://junglewise.ai/threats/cve-2026-73423-astro-composable-astro-hono-pipeline-csrf-via-origin-check-bypass)
- [Astro reflected XSS via unescaped View Transition animation properties](https://junglewise.ai/threats/cve-2026-73422-astro-reflected-xss-via-unescaped-view-transition-animation)