Cross-Site Request Forgery Vulnerability in Astro Framework by WithAstro

CVE-2026-73423

What is CVE-2026-73423?

The Astro Framework, used for content-driven web development, has a vulnerability that permits cross-origin form-encoded action requests to bypass security checks. Specifically, when users mount action handlers before applying middleware, it allows state-mutating actions to be executed by attackers using the victim's cookies. This occurs in scenarios where actions() and pages() can independently access user code, resulting in a potential blind write-only CSRF attack. The issue impacts versions 7.0.0 to 7.0.6 and has been addressed in version 7.0.6.

References