{"action":"Upgrade astro to 4.16.17 or later.","affected":[{"fixed":"4.16.17","introduced":"0"}],"component":"astro","cve_ids":["CVE-2024-56140"],"ecosystem":"npm","epss":0.00223,"exploited":false,"fixed_versions":["4.16.17"],"ghsa_id":"GHSA-c4pw-33h3-35xw","id":"tcs_01M5KFHQZ02T5ZEV23VCBA2VRQ","modified_at":"2025-11-27T08:18:05.038082Z","published_at":"2024-12-18T15:02:37Z","references":["https://osv.dev/vulnerability/GHSA-c4pw-33h3-35xw","https://github.com/withastro/astro/security/advisories/GHSA-c4pw-33h3-35xw","https://nvd.nist.gov/vuln/detail/CVE-2024-56140","https://github.com/withastro/astro/commit/e7d14c374b9d45e27089994a4eb72186d05514de","https://developer.mozilla.org/en-US/docs/Web/HTTP/CORS#simple_requests","https://github.com/withastro/astro","https://github.com/withastro/astro/blob/6031962ab5f56457de986eb82bd24807e926ba1b/packages/astro/src/core/app/middlewares.ts"],"severity":{"label":"medium","score":5.9},"sources":[{"source":"osv","source_id":"GHSA-c4pw-33h3-35xw","url":"https://osv.dev/vulnerability/GHSA-c4pw-33h3-35xw"}],"summary":"Atro CSRF Middleware Bypass (security.checkOrigin)"}