GHSA-8mv7-9c27-98vc: Astro: composable `astro/hono` pipeline bypasses `security.checkOrigin` when `middleware()` is absent or misordered
(updated )
In the composable astro/hono pipeline, the security.checkOrigin protection is only installed by the middleware() primitive. The actions() and pages() primitives each dispatch to user code independently, so a pipeline that mounts either primitive before (or without) middleware() will bypass the origin check for those requests.
References
- github.com/advisories/GHSA-8mv7-9c27-98vc
- github.com/withastro/astro/commit/0b30b35f864310bee8485c952d1877e82e2b9b1a
- github.com/withastro/astro/pull/17250
- github.com/withastro/astro/releases/tag/astro@7.0.6
- github.com/withastro/astro/security/advisories/GHSA-8mv7-9c27-98vc
- nvd.nist.gov/vuln/detail/CVE-2026-73423
Code Behaviors & Features
Detect and mitigate GHSA-8mv7-9c27-98vc with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →