Path Traversal Vulnerability in Astro Web Framework Affects Web Applications

CVE-2026-84376

What is CVE-2026-84376?

The Astro web framework, used for creating content-driven websites, has a vulnerability that allows an unauthorized remote attacker to bypass middleware authorization. Prior to version 7.2.4, Astro incorrectly handled base paths in request pathnames. Specifically, it stripped the configured non-root base path using a simple string-prefix check, failing to respect path-segment boundaries. This means that a request to a URL like '/appX/admin' could be misinterpreted as accessing the protected '/admin' route, thus granting access to restricted areas without proper authentication in applications that rely on the pathname for authorization. The issue has been addressed in version 7.2.4.

References