GHSA-8mv7-9c27-98vc: Cross-Site Request Forgery (CSRF) Bypass in Astro/Hono Composable Pipeline
Vulnerability ID: GHSA-8MV7-9C27-98VC
CVSS Score: 5.1
Published: 2026-07-20
A security vulnerability was identified in the Astro web framework's composable integration pipeline with Hono. Due to the structural coupling of CSRF origin validation exclusively within the middleware() primitive, applications assembling their routing pipeline manually could execute state-mutating actions before or entirely without origin validation. This flaw allows attackers to execute blind, write-only Cross-Site Request Forgery (CSRF) attacks against state-mutating Astro Actions or endpoints on behalf of authenticated users.
TL;DR
A structural coupling flaw in the Astro/Hono composable pipeline allowed Astro's CSRF origin-check to be bypassed. If developers mounted the actions dispatcher before the global middleware dispatcher, or omitted the middleware entirely, incoming POST requests were processed without validating the Origin header, leading to blind CSRF vulnerabilities on state-mutating endpoints.
⚠️ Exploit Status: POC
Technical Details
- CWE ID: CWE-352
- Attack Vector: Network (AV:N)
- CVSS v4.0 Score: 5.1 (Medium)
- EPSS Score: Not Available (No CVE Assigned)
- Impact: Blind Write-Only Cross-Site Request Forgery (CSRF)
- Exploit Status: Proof-of-Concept Conceptual
- KEV Status: Not Listed
Affected Systems
- Astro web applications utilizing custom astro/hono pipelines with manual integration primitive assembly.
-
astro: >= 7.0.0, < 7.0.6 (Fixed in:
7.0.6)
Code Analysis
Commit: 0b30b35
Fix composable pipeline bypass by enforcing origin-check in action and page dispatchers.
Mitigation Strategies
- Upgrade Astro to version 7.0.6 or higher.
- Reorder routing configuration in Hono to ensure middleware() is registered before actions() and pages().
- Implement strict reverse proxy rules to validate incoming Host and X-Forwarded-Host headers.
Remediation Steps:
- Check current Astro version using npm list astro or pnpm list astro.
- Run dependency update commands: npm install astro@7.0.6.
- Review Hono integration entry points (e.g., server.ts, index.ts) and verify that app.use(middleware()) is located above other endpoints.
References
- GitHub Security Advisory GHSA-8mv7-9c27-98vc
- Astro Project Security Advisory
- Astro 7.0.6 Release Notes
Read the full report for GHSA-8MV7-9C27-98VC on our website for more details including interactive diagrams and full exploit analysis.
Top comments (0)