{"id":"CVE-2026-84376","title":"Astro is a web framework for content-driven websites","summary":"Astro is a web framework for content-driven websites. Prior to 7.2.4, Astro stripped a configured non-root base path from request pathnames using a string-prefix check without verifying a path-segment boundary. With base \"/app\", a reques…","severity":"medium","cwe":["CWE-187"],"vendor":"astro","product":"astro","affected":["astro <= 7.2.3"],"patched":["astro 7.2.4"],"published":"2026-09-02","updated":"2026-09-09","sourceUpdated":"2026-09-09T21:04:42.813","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-84376","references":[{"url":"https://github.com/withastro/astro/commit/05763a0884aabb1da78a2749d5bb9d41ae620527","label":"security-advisories@github.com"},{"url":"https://github.com/withastro/astro/pull/17701","label":"security-advisories@github.com"},{"url":"https://github.com/withastro/astro/releases/tag/astro@7.2.4","label":"security-advisories@github.com"},{"url":"https://github.com/withastro/astro/security/advisories/GHSA-376h-93r7-7g6f","label":"security-advisories@github.com"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-84376"},{"url":"https://github.com/advisories/GHSA-376h-93r7-7g6f"}],"tags":["nvd","ghsa","npm"],"epss":0.00407,"epssPercentile":0.34713,"aliases":["GHSA-376h-93r7-7g6f"],"ecosystem":"npm","ingestedAt":"2026-09-08T22:12:30.968Z","slug":"CVE-2026-84376","body":"## Overview\n\nAstro is a web framework for content-driven websites. Prior to 7.2.4, Astro stripped a configured non-root base path from request pathnames using a string-prefix check without verifying a path-segment boundary. With base \"/app\", a request to \"/appX/admin\" resolved internally to the protected \"/admin\" route while middleware observed \"/appX/admin\" in context.url.pathname. In applications that authorize base-prefixed routes by inspecting context.url.pathname, an unauthenticated remote attacker could bypass pathname-based middleware authorization and reach protected routes. This issue is fixed in version 7.2.4.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.\n\n## Package advisory (CVE-2026-84376)\n\nAffected packages:\n\n- `astro <= 7.2.3`\n\nPatched in:\n\n- `astro 7.2.4`\n\nSource: https://github.com/advisories/GHSA-376h-93r7-7g6f","depth":"sunlit","depthScore":28,"depthScoreParts":{"impact":27.5,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}