Packages / astro / Security

ModerateVulnerabilityGHSA-8mv7-9c27-98vcPublished 20 Jul 2026

Astro: composable `astro/hono` pipeline bypasses `security.checkOrigin` when `middleware()` is absent or misordered

Affected · astro

  • >= 7.0.0, < 7.0.6

Fixed in

7.0.6

npm install astro@7.0.6

  1. Not affected

    0.0.1 – 6.4.8

    691 releases

  2. Affected

    7.0.0 – 7.0.5

    6 releases

  3. Fixed

    7.0.6 – 7.4.1

    33 releases, latest

730 stable releases of astro, oldest to newest.

What happens

The full text is not stored yet. Read it on osv.dev.