---
id: CVE-2026-84376
title: Astro is a web framework for content-driven websites
summary: >-
  Astro is a web framework for content-driven websites. Prior to 7.2.4, Astro
  stripped a configured non-root base path from request pathnames using a
  string-prefix check without verifying a path-segment boundary. With base
  "/app", a reques…
severity: medium
cwe:
  - CWE-187
vendor: astro
product: astro
affected:
  - astro <= 7.2.3
patched:
  - astro 7.2.4
published: '2026-09-02'
updated: '2026-09-09'
sourceUpdated: '2026-09-09T21:04:42.813'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-84376'
references:
  - url: >-
      https://github.com/withastro/astro/commit/05763a0884aabb1da78a2749d5bb9d41ae620527
    label: security-advisories@github.com
  - url: 'https://github.com/withastro/astro/pull/17701'
    label: security-advisories@github.com
  - url: 'https://github.com/withastro/astro/releases/tag/astro@7.2.4'
    label: security-advisories@github.com
  - url: 'https://github.com/withastro/astro/security/advisories/GHSA-376h-93r7-7g6f'
    label: security-advisories@github.com
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-84376'
  - url: 'https://github.com/advisories/GHSA-376h-93r7-7g6f'
tags:
  - nvd
  - ghsa
  - npm
epss: 0.00407
epssPercentile: 0.34713
aliases:
  - GHSA-376h-93r7-7g6f
ecosystem: npm
ingestedAt: '2026-09-08T22:12:30.968Z'
---

## Overview

Astro is a web framework for content-driven websites. Prior to 7.2.4, Astro stripped a configured non-root base path from request pathnames using a string-prefix check without verifying a path-segment boundary. With base "/app", a request to "/appX/admin" resolved internally to the protected "/admin" route while middleware observed "/appX/admin" in context.url.pathname. In applications that authorize base-prefixed routes by inspecting context.url.pathname, an unauthenticated remote attacker could bypass pathname-based middleware authorization and reach protected routes. This issue is fixed in version 7.2.4.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

## Package advisory (CVE-2026-84376)

Affected packages:

- `astro <= 7.2.3`

Patched in:

- `astro 7.2.4`

Source: https://github.com/advisories/GHSA-376h-93r7-7g6f