GHSA-376h-93r7-7g6f: Npm/astro vulnerability
Summary
Astro stripped a configured base path from request pathnames using a string-prefix check that did not verify a path-segment boundary. With base: "/app", a request to /appX/admin was treated as being under the base and resolved internally to the /admin route, while middleware still observed the public pathname /appX/admin. Middleware that authorizes routes by inspecting context.url.pathname could therefore be bypassed.
Impact
An unauthenticated remote attacker can bypass pathname-based middleware authorization in applications that:
- Configure a non-root base. - Protect base-prefixed routes in middleware using context.url.pathname.
Because routing and middleware resolved different effective pathnames, a request such as /appX/admin (or other single-character extensions like /app2/admin or /app-/admin) reached the protected /admin route without passing the middleware check that guards /app/admin. Astro's authentication guide demonstrates protecting routes in middleware via context.url.pathname, so this is a reasonable and expected pattern.
Affected versions
astro <= 7.2.3.
Patches
Fixed in astro 7.2.4. Base stripping now requires the pathname to equal the base without its trailing slash, or to be followed by a /, so a prefix that does not end on a path-segment boundary is no longer treated as being under the base. Routing and context.url.pathname now resolve the same pathname.
Workarounds
Upgrade to astro 7.2.4 or later. As a mitigation before upgrading, avoid relying solely on prefix checks of context.url.pathname for authorization, or reject requests whose pathname does not begin with the configured base followed by a path-segment boundary.
Credits
Reported by @Ryoga-exe.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
npm/astroto a version that resolves this vulnerability.Fixed in 7.2.4 - Upgrade
Upgrade
astroto a version that resolves this vulnerability.Fixed in 7.2.4 - Configuration
As a mitigation before upgrading, avoid relying solely on prefix checks of `context.url.pathname` for authorization. Reject requests whose pathname does not begin with the configured `base` followed by a path-segment boundary (e.g., accept only if pathname equals base (no trailing slash) or starts with base + `/`).
Astro middleware (path-based authorization) Base stripping / pathname prefix validation = Require base match only when pathname equals base without trailing slash or the next character is `/` - Compensating control
Protect base-prefixed routes in middleware by validating `context.url.pathname` with a path-segment boundary check, not a raw string prefix (e.g., ensure the base match ends on a boundary before authorizing routes).
Event History
Frequently Asked Questions
Which deployments are exposed to this bypass?
Applications using astro version 7.2.3 or earlier are exposed if they configure a non-root base path and use middleware that authorizes base-prefixed routes by checking context.url.pathname. Applications without that combination are not described as affected.
What does an attacker need to send to exploit it?
An unauthenticated remote attacker can request a pathname that starts with the configured base but continues with an additional character rather than a path separator. For example, with base set to /app, requests such as /appX/admin, /app2/admin, or /app-/admin can reach the internal /admin route while middleware sees the different public pathname.
How can I tell whether my middleware authorization may be bypassable?
Review middleware that compares context.url.pathname to base-prefixed protected paths, such as /app/admin, and check whether the application uses a non-root base. Test whether a single-character extension of the base followed by a protected route, such as /appX/admin, reaches that route without the expected middleware authorization.
What version fixes the issue?
The issue is fixed in astro 7.2.4. The fix requires base stripping to match a path-segment boundary rather than only a string prefix.