CVE-2026-73423

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-73423", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-08-12T14:32:11.795Z", "datePublished": "2026-08-12T20:35:32.181Z", "dateUpdated": "2026-08-13T17:53:25.469Z"}, "containers": {"cna": {"title": "Astro: composable `astro/hono` pipeline bypasses `security.checkOrigin` when `middleware()` is absent or misordered", "problemTypes": [{"descriptions": [{"cweId": "CWE-352", "lang": "en", "description": "CWE-352: Cross-Site Request Forgery (CSRF)", "type": "CWE"}]}], "metrics": [{"cvssV4_0": {"attackVector": "NETWORK", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "userInteraction": "ACTIVE", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "LOW", "subAvailabilityImpact": "NONE", "baseScore": 5.1, "baseSeverity": "MEDIUM", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N", "version": "4.0"}}], "references": [{"name": "https://github.com/withastro/astro/security/advisories/GHSA-8mv7-9c27-98vc", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/withastro/astro/security/advisories/GHSA-8mv7-9c27-98vc"}, {"name": "https://github.com/withastro/astro/pull/17250", "tags": ["x_refsource_MISC"], "url": "https://github.com/withastro/astro/pull/17250"}, {"name": "https://github.com/withastro/astro/commit/0b30b35f864310bee8485c952d1877e82e2b9b1a", "tags": ["x_refsource_MISC"], "url": "https://github.com/withastro/astro/commit/0b30b35f864310bee8485c952d1877e82e2b9b1a"}, {"name": "https://github.com/withastro/astro/releases/tag/astro@7.0.6", "tags": ["x_refsource_MISC"], "url": "https://github.com/withastro/astro/releases/tag/astro@7.0.6"}], "affected": [{"vendor": "withastro", "product": "astro", "versions": [{"version": ">= 7.0.0, < 7.0.6", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-08-12T20:35:32.181Z"}, "descriptions": [{"lang": "en", "value": "Astro is a web framework for content-driven websites. From 7.0.0 until 7.0.6, the composable astro/hono pipeline installs security.checkOrigin only through the middleware() primitive, while actions() and pages() can dispatch to user code independently. Mounting actions() before middleware(), as in the examples/advanced-routing example and Cloudflare Hono documentation, allows cross-origin form-encoded action requests to execute before the origin check, and using pages() without middleware() drops the check for on-demand endpoints and pages. The flaw enables blind write-only cross-site request forgery using the victim's cookies against ActionHandler.handle and PagesHandler.handleWithErrorFallback when manifest.checkOrigin is enabled; the attacker can trigger a state-mutating action or endpoint handler but cannot read the cross-origin response. The default non-composable astro() pipeline is not affected. This issue is fixed in version 7.0.6."}], "source": {"advisory": "GHSA-8mv7-9c27-98vc", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-08-13T17:49:22.329880Z", "id": "CVE-2026-73423", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-13T17:53:25.469Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-73423", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-08-13T17:49:22.329880Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-13T17:49:23.686Z"}}], "cna": {"title": "Astro: composable `astro/hono` pipeline bypasses `security.checkOrigin` when `middleware()` is absent or misordered", "source": {"advisory": "GHSA-8mv7-9c27-98vc", "discovery": "UNKNOWN"}, "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 5.1, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N", "userInteraction": "ACTIVE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "LOW", "vulnIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "NONE"}}], "affected": [{"vendor": "withastro", "product": "astro", "versions": [{"status": "affected", "version": ">= 7.0.0, < 7.0.6"}]}], "references": [{"url": "https://github.com/withastro/astro/security/advisories/GHSA-8mv7-9c27-98vc", "name": "https://github.com/withastro/astro/security/advisories/GHSA-8mv7-9c27-98vc", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/withastro/astro/pull/17250", "name": "https://github.com/withastro/astro/pull/17250", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/withastro/astro/commit/0b30b35f864310bee8485c952d1877e82e2b9b1a", "name": "https://github.com/withastro/astro/commit/0b30b35f864310bee8485c952d1877e82e2b9b1a", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/withastro/astro/releases/tag/astro@7.0.6", "name": "https://github.com/withastro/astro/releases/tag/astro@7.0.6", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "Astro is a web framework for content-driven websites. From 7.0.0 until 7.0.6, the composable astro/hono pipeline installs security.checkOrigin only through the middleware() primitive, while actions() and pages() can dispatch to user code independently. Mounting actions() before middleware(), as in the examples/advanced-routing example and Cloudflare Hono documentation, allows cross-origin form-encoded action requests to execute before the origin check, and using pages() without middleware() drops the check for on-demand endpoints and pages. The flaw enables blind write-only cross-site request forgery using the victim's cookies against ActionHandler.handle and PagesHandler.handleWithErrorFallback when manifest.checkOrigin is enabled; the attacker can trigger a state-mutating action or endpoint handler but cannot read the cross-origin response. The default non-composable astro() pipeline is not affected. This issue is fixed in version 7.0.6."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-352", "description": "CWE-352: Cross-Site Request Forgery (CSRF)"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-08-12T20:35:32.181Z"}}}, "cveMetadata": {"cveId": "CVE-2026-73423", "state": "PUBLISHED", "dateUpdated": "2026-08-13T17:53:25.469Z", "dateReserved": "2026-08-12T14:32:11.795Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-08-12T20:35:32.181Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "astro", "vendor": "withastro", "versions": [{"status": "affected", "version": ">= 7.0.0, < 7.0.6"}]}], "source": "security-advisories@github.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Astro is a web framework for content-driven websites. From 7.0.0 until 7.0.6, the composable astro/hono pipeline installs security.checkOrigin only through the middleware() primitive, while actions() and pages() can dispatch to user code independently. Mounting actions() before middleware(), as in the examples/advanced-routing example and Cloudflare Hono documentation, allows cross-origin form-encoded action requests to execute before the origin check, and using pages() without middleware() drops the check for on-demand endpoints and pages. The flaw enables blind write-only cross-site request forgery using the victim's cookies against ActionHandler.handle and PagesHandler.handleWithErrorFallback when manifest.checkOrigin is enabled; the attacker can trigger a state-mutating action or endpoint handler but cannot read the cross-origin response. The default non-composable astro() pipeline is not affected. This issue is fixed in version 7.0.6."}, {"lang": "es", "value": "Astro es un framework web para sitios web basados en contenido. Desde la versi\u00f3n 7.0.0 hasta la 7.0.6, la pipeline componible astro/hono instala security.checkOrigin solo a trav\u00e9s de la primitiva middleware(), mientras que actions() y pages() pueden despachar a c\u00f3digo de usuario de forma independiente. Montar actions() antes de middleware(), como en el ejemplo examples/advanced-routing y la documentaci\u00f3n de Cloudflare Hono, permite que las peticiones de acci\u00f3n codificadas en farmulario de origen cruzado se ejecuten antes de la verificaci\u00f3n de origen, y usar pages() sin middleware() omite la verificaci\u00f3n para endpoints y p\u00e1ginas bajo demya. La vulnerabilidad permite la falsificaci\u00f3n de petici\u00f3n en sitios cruzados ciega de solo escritura utilizyo las cookies de la v\u00edctima contra ActionHyler.hyle y PagesHyler.hyleWithErrorFallback cuyo manifest.checkOrigin est\u00e1 habilitado; el atacante puede desencadenar una acci\u00f3n o un gestor de endpoint que muta el estado, pero no puede leer la respuesta de origen cruzado. La pipeline astro() no componible predeterminada no se ve afectada. Este problema est\u00e1 solucionado en la versi\u00f3n 7.0.6."}], "id": "CVE-2026-73423", "lastModified": "2026-10-24T15:10:00.190", "metrics": {"cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 5.1, "baseSeverity": "MEDIUM", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "LOW", "userInteraction": "ACTIVE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-73423", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-08-13T17:49:22.329880Z", "version": "2.0.3"}}]}, "published": "2026-08-12T21:17:41.340", "references": [{"source": "security-advisories@github.com", "url": "https://github.com/withastro/astro/commit/0b30b35f864310bee8485c952d1877e82e2b9b1a"}, {"source": "security-advisories@github.com", "url": "https://github.com/withastro/astro/pull/17250"}, {"source": "security-advisories@github.com", "url": "https://github.com/withastro/astro/releases/tag/astro@7.0.6"}, {"source": "security-advisories@github.com", "url": "https://github.com/withastro/astro/security/advisories/GHSA-8mv7-9c27-98vc"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-352"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[7.0.0,7.0.6)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "astro", "source": "cna", "vendor": "withastro"}, "product": "astro", "vendor": "withastro"}], "created": "2026-08-12T22:15:06.518433+00:00", "updated": "2026-08-12T22:30:09.821783+00:00", "vendors": ["withastro", "withastro$PRODUCT$astro"]}