Easily map the attack path and prioritize which CVEs are a threat to your organization
Miggo AIGenerate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| astro | npm | <= 7.2.3 | 7.2.4 |
Miggo AIRoot Cause AnalysisThe vulnerability, CVE-2026-84376, is an authorization bypass in Astro caused by a partial string comparison when stripping a configured base path from request URLs. The core of the issue lies in several functions that used pathname.startsWith(base) to remove the base path. This check was insufficient because it didn't validate that the prefix ended on a path-segment boundary (i.e., followed by a / or being the exact path).
An attacker could exploit this by crafting a URL like /appX/admin where the configured base is /app. The vulnerable code would incorrectly identify /app as the base, strip it, and forward the request to the /admin route internally. However, middleware inspecting context.url.pathname would see the full /appX/admin path. If the middleware was configured to protect /app/admin, it would not recognize this crafted path, thus bypassing the authorization check.
The patch replaces the simple startsWith logic with a new stripRequestBase function. This new function correctly verifies path-segment boundaries, ensuring that a path like /appX is not considered to be under the /app base. The analysis identified four key locations where this vulnerable logic existed before the patch: BaseApp.removeBase, FetchState.#computePathname, and local removeBase functions in match-request.ts and domain.ts.
BaseApp.removeBasepackages/astro/src/core/app/base.ts
FetchState.#computePathnamepackages/astro/src/core/fetch/fetch-state.ts
removeBasepackages/astro/src/core/routing/match-request.ts
removeBasepackages/astro/src/core/i18n/domain.ts