Astro versions 7.0.0 to 7.0.5 using the composable astro/hono pipeline are vulnerable to CSRF due to the security.checkOrigin middleware being applied only through middleware(). If actions() is mounted before middleware(), or pages() is used without middleware(), cross-origin form-encoded requests can trigger state-mutating handlers before origin verification. This enables blind write-only CSRF attacks using victim cookies against ActionHandler.handle and PagesHandler.handleWithErrorFallback when manifest.checkOrigin is enabled. The default non-composable astro() pipeline is not affected. The vulnerability is resolved in version 7.0.6.

An attacker can induce a victim's browser to send cross-origin requests that mutate state on the target server without the victim's consent or knowledge. The attacker cannot read the response, so the attack is blind, but state changes can still occur. This can lead to unauthorized actions being performed on behalf of the victim. The vulnerability requires the use of the composable astro/hono pipeline with manifest.checkOrigin enabled and improper middleware ordering or omission. The default pipeline is not affected.

A fix is available in astro version 7.0.6. Users should upgrade to version 7.0.6 or later to resolve this CSRF vulnerability. Since this is a cloud service, the vendor typically manages remediation server-side; users should verify with the vendor advisory for confirmation. Until patched, ensure that middleware() is mounted before actions() and pages(), or avoid using pages() without middleware(), to maintain the origin check. Follow the vendor's official guidance for secure pipeline configuration.