https://db.gcve.eu/rss/recent/all/10 Most recent entries from all 2026-10-05T11:39:07.830774+00:00 Vulnerability-Lookup info@gcve.eu python-feedgen Contains only the most 10 recent entries. https://db.gcve.eu/vuln/fkie_cve-2026-84376 fkie_cve-2026-84376 2026-10-05T11:39:07.832850+00:00

Astro is a web framework for content-driven websites. Prior to 7.2.4, Astro stripped a configured non-root base path from request pathnames using a string-prefix check without verifying a path-segment boundary. With base "/app", a request to "/appX/admin" resolved internally to the protected "/admin" route while middleware observed "/appX/admin" in context.url.pathname. In applications that authorize base-prefixed routes by inspecting context.url.pathname, an unauthenticated remote attacker could bypass pathname-based middleware authorization and reach protected routes. This issue is fixed in version 7.2.4.

 https://db.gcve.eu/vuln/ghsa-376h-93r7-7g6f GHSA-376h-93r7-7g6f — Astro: Authorization bypass from missing path-segment boundary check when stripping the configured base 2026-10-05T11:39:07.832945+00:00

Affected: npm: astro

## Summary

Astro stripped a configured `base` path from request pathnames using a string-prefix check that did not verify a path-segment boundary. With `base: "/app"`, a request to `/appX/admin` was treated as being under the base and resolved internally to the `/admin` route, while middleware still observed the public pathname `/appX/admin`. Middleware that authorizes routes by inspecting `context.url.pathname` could therefore be bypassed.

## Impact

An unauthenticated remote attacker can bypass pathname-based middleware authorization in applications that:

- Configure a non-root `base`. - Protect base-prefixed routes in middleware using `context.url.pathname`.

Because routing and middleware resolved different effective pathnames, a request such as `/appX/admin` (or other single-character extensions like `/app2/admin` or `/app-/admin`) reached the protected `/admin` route without passing the middleware check that guards `/app/admin`. Astro's authentication guide demonstrates protecting routes in middleware via `context.url.pathname`, so this is a reasonable and expected pattern.

## Affected versions

`astro` <= 7.2.3.

## Patches

Fixed in `astro` 7.2.4. Base stripping now requires the pathname to equal the base without its trailing slash, or to be followed by a `/`, so a prefix that does not end on a path-segment boundary is no longer treated as being under the base. Routing and `context.url.pathname` now resolve the same pathname.

## Workarounds

Upgrade to `astro` 7…