https://db.gcve.eu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Mon, 05 Oct 2026 11:39:08 +0000 https://db.gcve.eu/vuln/fkie_cve-2026-84376 <p>Astro is a web framework for content-driven websites. Prior to 7.2.4, Astro stripped a configured non-root base path from request pathnames using a string-prefix check without verifying a path-segment boundary. With base &#34;/app&#34;, a request to &#34;/appX/admin&#34; resolved internally to the protected &#34;/admin&#34; route while middleware observed &#34;/appX/admin&#34; in context.url.pathname. In applications that authorize base-prefixed routes by inspecting context.url.pathname, an unauthenticated remote attacker could bypass pathname-based middleware authorization and reach protected routes. This issue is fixed in version 7.2.4.</p> <p>Astro is a web framework for content-driven websites. Prior to 7.2.4, Astro stripped a configured non-root base path from request pathnames using a string-prefix check without verifying a path-segment boundary. With base &#34;/app&#34;, a request to &#34;/appX/admin&#34; resolved internally to the protected &#34;/admin&#34; route while middleware observed &#34;/appX/admin&#34; in context.url.pathname. In applications that authorize base-prefixed routes by inspecting context.url.pathname, an unauthenticated remote attacker could bypass pathname-based middleware authorization and reach protected routes. This issue is fixed in version 7.2.4.</p> https://db.gcve.eu/vuln/fkie_cve-2026-84376 https://db.gcve.eu/vuln/ghsa-376h-93r7-7g6f <p><strong>Affected:</strong> npm: astro</p> <p>## Summary</p> <p>Astro stripped a configured `base` path from request pathnames using a string-prefix check that did not verify a path-segment boundary. With `base: &#34;/app&#34;`, a request to `/appX/admin` was treated as being under the base and resolved internally to the `/admin` route, while middleware still observed the public pathname `/appX/admin`. Middleware that authorizes routes by inspecting `context.url.pathname` could therefore be bypassed.</p> <p>## Impact</p> <p>An unauthenticated remote attacker can bypass pathname-based middleware authorization in applications that:</p> <p>- Configure a non-root `base`. - Protect base-prefixed routes in middleware using `context.url.pathname`.</p> <p>Because routing and middleware resolved different effective pathnames, a request such as `/appX/admin` (or other single-character extensions like `/app2/admin` or `/app-/admin`) reached the protected `/admin` route without passing the middleware check that guards `/app/admin`. Astro&#39;s authentication guide demonstrates protecting routes in middleware via `context.url.pathname`, so this is a reasonable and expected pattern.</p> <p>## Affected versions</p> <p>`astro` &lt;= 7.2.3.</p> <p>## Patches</p> <p>Fixed in `astro` 7.2.4. Base stripping now requires the pathname to equal the base without its trailing slash, or to be followed by a `/`, so a prefix that does not end on a path-segment boundary is no longer treated as being under the base. Routing and `context.url.pathname` now resolve the same pathname.</p> <p>## Workarounds</p> <p>Upgrade to `astro` 7…</p> <p><strong>Affected:</strong> npm: astro</p> <p>## Summary</p> <p>Astro stripped a configured `base` path from request pathnames using a string-prefix check that did not verify a path-segment boundary. With `base: &#34;/app&#34;`, a request to `/appX/admin` was treated as being under the base and resolved internally to the `/admin` route, while middleware still observed the public pathname `/appX/admin`. Middleware that authorizes routes by inspecting `context.url.pathname` could therefore be bypassed.</p> <p>## Impact</p> <p>An unauthenticated remote attacker can bypass pathname-based middleware authorization in applications that:</p> <p>- Configure a non-root `base`. - Protect base-prefixed routes in middleware using `context.url.pathname`.</p> <p>Because routing and middleware resolved different effective pathnames, a request such as `/appX/admin` (or other single-character extensions like `/app2/admin` or `/app-/admin`) reached the protected `/admin` route without passing the middleware check that guards `/app/admin`. Astro&#39;s authentication guide demonstrates protecting routes in middleware via `context.url.pathname`, so this is a reasonable and expected pattern.</p> <p>## Affected versions</p> <p>`astro` &lt;= 7.2.3.</p> <p>## Patches</p> <p>Fixed in `astro` 7.2.4. Base stripping now requires the pathname to equal the base without its trailing slash, or to be followed by a `/`, so a prefix that does not end on a path-segment boundary is no longer treated as being under the base. Routing and `context.url.pathname` now resolve the same pathname.</p> <p>## Workarounds</p> <p>Upgrade to `astro` 7…</p> https://db.gcve.eu/vuln/ghsa-376h-93r7-7g6f