Astro CVE-2026-73423

Exploitation requires all four of the following conditions: (1) the target application uses the composable astro/hono pipeline - NOT the default astro() all-in-one pipeline, which is fully unaffected; (2) within that pipeline, either actions() is mounted before middleware() OR pages() is used without middleware() being present at all; (3) security.checkOrigin is true, which is the framework default and therefore met in virtually all unmodified installations; and (4) the victim must hold an active authenticated session on the target application AND must visit an attacker-controlled page that submits a cross-origin form request. What limits exploitation: the vulnerable pipeline configuration is explicitly opt-in and non-default; the attacker cannot read the cross-origin response body, restricting the attack to blind state mutation only; and the attack surface is limited to POST/PUT/PATCH/DELETE endpoints with form-encoded content types (application/x-www-form-urlencoded, multipart/form-data, text/plain) - JSON API calls are not covered by this origin check mechanism.

The CVSS 4.0 score of 5.1 (Medium, AV:N/AC:L/AT:N/PR:N/UI:A/SC:N/SI:L/SA:N) accurately reflects real-world risk: the attack requires no attacker privileges and is network-based with low complexity, but active victim interaction is required and the impact is limited to blind integrity mutation of subsequent-system state with no confidentiality or availability consequence. EPSS data is not present in the provided intelligence, so probabilistic exploitation likelihood cannot be quantified. No CISA KEV listing and no public POC exist at time of analysis, indicating this is not confirmed actively exploited. Critically, the true exposed population is significantly narrower than the raw version range implies: only deployments using the composable astro/hono pipeline with a misordered or absent middleware() are affected. The risk is amplified by the fact that the official examples/advanced-routing example and Cloudflare Hono documentation shipped the vulnerable ordering, meaning developers following canonical guidance were unknowingly vulnerable.

An attacker hosts a webpage containing a hidden HTML form whose action attribute targets a state-mutating Astro Action endpoint on the victim's server (e.g., an account-settings update or funds-transfer action). When an authenticated victim visits the attacker's page - via a phishing link or a malicious ad - the browser auto-submits the form with the victim's session cookies attached. Because the composable pipeline processes actions() before middleware(), the CSRF origin check never runs, and the Astro Action handler executes the state mutation (account change, data write, transaction trigger) using the victim's authenticated session without their awareness. No public POC is known at time of analysis.