-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability stems from the middleware's Content-Type handling in createOriginCheckMiddleware. The original code used FORM_CONTENT_TYPES.includes(contentType.toLowerCase()) which required exact MIME type matches, failing to account for: 1) parameters in Content-Type headers (application/x-www-form-urlencoded; abc), and 2) requests without Content-Type headers. The patched commit introduced hasFormLikeHeader with .includes() checks and separate handling for missing headers, confirming these were the vulnerable code paths. The file path and function name are explicitly referenced in both the vulnerability details and commit diff.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| astro | npm | < 4.16.17 | 4.16.17 |
// Pattern 2.1 Request without body
fetch('http://test.example.com', { method: 'POST', credentials: 'include' });
// Pattern 2.2 Blob object without type
fetch('https://test.example.com', {
method: 'POST',
credentials: 'include',
body: new Blob(['a=b'], {}),
});
Bypass CSRF protection implemented with CSRF middleware.
[!Note] Even with
credentials: 'include', browsers may not send cookies due to third-party cookie blocking. This feature depends on the browser version and settings, and is for privacy protection, not as a CSRF measure.
Ongoing coverage of React2Shell