CVE-2026-84376: CWE-187: Partial String Comparison in withastro astro
Description
Astro is a web framework for content-driven websites. Prior to 7.2.4, Astro stripped a configured non-root base path from request pathnames using a string-prefix check without verifying a path-segment boundary. With base "/app", a request to "/appX/admin" resolved internally to the protected "/admin" route while middleware observed "/appX/admin" in context.url.pathname. In applications that authorize base-prefixed routes by inspecting context.url.pathname, an unauthenticated remote attacker could bypass pathname-based middleware authorization and reach protected routes. This issue is fixed in version 7.2.4.
CVSS v4.0
Score 6.3medium
Affected software
withastro
astro
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The vulnerability in Astro (a web framework) involves improper handling of base path stripping before version 7.2.4. The framework uses a string-prefix check to remove a configured non-root base path from request pathnames but does not verify path-segment boundaries. This allows an attacker to craft requests that appear to be under the base path but actually resolve to protected routes internally, bypassing middleware authorization that relies on the original pathname. This is classified as CWE-187 (Partial Comparison). The vulnerability has a CVSS 4.0 score of 6.3 (medium severity).
Potential Impact
An unauthenticated remote attacker can bypass pathname-based middleware authorization and access protected routes by exploiting the partial string comparison flaw in base path stripping. This could lead to unauthorized access to sensitive application endpoints that are otherwise protected by middleware checks.
Mitigation Recommendations
This vulnerability is fixed in Astro version 7.2.4. Users should upgrade to version 7.2.4 or later to remediate this issue. Patch status is not explicitly confirmed in the vendor advisory, but the description states the issue is fixed in 7.2.4. No other mitigation or temporary workaround is indicated.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- GitHub_M
- Date Reserved
- 2026-09-01T16:27:58.129Z
- Cvss Version
- 4.0
- State
- PUBLISHED
Threat ID: 6a9850dfacd9273b4977c5a1
Added to database: 09/02/2026, 16:37:51 UTC
Last enriched: 09/07/2026, 12:33:51 UTC
Last updated: 10/17/2026, 18:48:23 UTC
Views: 90
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.