CVE-2026-73423 - Astro: composable `astro/hono` pipeline bypasses `security.checkOrigin` when `middleware()` is absent or misordered
Brief
CVE ID : CVE-2026-73423
Published : Aug. 12, 2026, 8:35 p. m.
- 29 minutes ago
Description : Astro is a web framework for content-driven websites. From 7.
- 0 until 7.
- 6, the composable astro/hono pipeline installs security. checkOrigin only through the middleware() primitive, while actions() and pages() can dispatch to user code independently.
Mounting actions() before middleware(), as in the examples/advanced-routing example and Cloudflare Hono documentation, allows cross-origin form-encoded action requests to execute before the origin check, and using pages() without middleware() drops the check for on-demand endpoints and pages. The flaw enables blind write-only cross-site request forgery using the victim's cookies against ActionHandler.
handle and PagesHandler. handleWithErrorFallback when manifest.