CVE-2026-84376 Details

A vulnerability in Astro versions through 7.2.3 allows unauthorized access to protected routes by bypassing middleware authorization. The issue arises from the framework's method of stripping non-root base paths from request URLs. This process relied on a simple prefix check that failed to consider path-segment boundaries. As a result, requests to paths like '/appX/admin' were incorrectly routed to the '/admin' endpoint while the middleware still recognized the original path, creating a mismatch that could be exploited. This vulnerability affects applications that use base-prefixed routes and authorize them through the 'context.url.pathname' variable.

Users can upgrade to Astro version 7.2.4 or later, where this vulnerability is fixed. As an additional step, avoid relying solely on prefix checks of 'context.url.pathname' for authorization, or reject requests whose pathname does not begin with the configured base followed by a path-segment boundary.