{"action":"Upgrade astro to 7.0.6 or later.","affected":[{"fixed":"7.0.6","introduced":"7.0.0"}],"component":"astro","cve_ids":["CVE-2026-73423"],"ecosystem":"npm","epss":0.00264,"exploited":false,"fixed_versions":["7.0.6"],"ghsa_id":"GHSA-8mv7-9c27-98vc","id":"tcs_01M5KFDJ9DVD98EV8BY1QXF4VR","modified_at":"2026-08-12T20:56:01.953813Z","published_at":"2026-07-20T23:26:27Z","references":["https://osv.dev/vulnerability/GHSA-8mv7-9c27-98vc","https://github.com/withastro/astro/security/advisories/GHSA-8mv7-9c27-98vc","https://github.com/withastro/astro/pull/17250","https://github.com/withastro/astro/commit/0b30b35f864310bee8485c952d1877e82e2b9b1a","https://github.com/withastro/astro","https://github.com/withastro/astro/releases/tag/astro@7.0.6"],"severity":{"label":"medium"},"sources":[{"source":"osv","source_id":"GHSA-8mv7-9c27-98vc","url":"https://osv.dev/vulnerability/GHSA-8mv7-9c27-98vc"}],"summary":"Astro: composable `astro/hono` pipeline bypasses `security.checkOrigin` when `middleware()` is absent or misordered"}