Atro CSRF Middleware Bypass (security.checkOrigin)

Description

A bug in Astro’s CSRF-protection middleware allows requests to bypass CSRF checks.

Recommendation

Update the astro package to the latest compatible version. Followings are version details:

• Affected version(s): < 4.16.17
• Patched version(s): 4.16.17

References

• GHSA-c4pw-33h3-35xw
• developer.mozilla.org
• CVE-2024-56140
• CWE-352
• CAPEC-310
• OWASP 2021-A1
• OWASP 2021-A6

Related Issues

• Astro allows unauthorized third-party images in _image endpoint - CVE-2025-55303
• Astros's duplicate trailing slash feature leads to an open redirection security issue - CVE-2025-54793
• Better Call routing bug can lead to Cache Deception - Vulnerability
• Cross-site Scripting (XSS) in serialize-javascript - CVE-2024-11831

Tags:

npm

astro