Skip to content

Update dependency astro to v7.2.8 [SECURITY] - autoclosed - #11

Closed
renovate[bot] wants to merge 1 commit into
mainfrom
renovate/npm-astro-vulnerability
Closed

Update dependency astro to v7.2.8 [SECURITY] - autoclosed#11
renovate[bot] wants to merge 1 commit into
mainfrom
renovate/npm-astro-vulnerability

Conversation

@renovate

@renovate renovate Bot commented Sep 10, 2026

Copy link
Copy Markdown
Contributor

This PR contains the following updates:

Package Change Age Confidence
astro (source) 7.2.2 → 7.2.8 age confidence

Astro: Remote code execution through AVIF image optimization

GHSA-26w7-cxv4-gfx2

More information

Details

A vulnerability in libheif, used by the default Sharp image service in Astro, can lead to remote code execution when a malicious AVIF image is optimized.

Projects are affected when an attacker can cause Astro to process an untrusted AVIF image.

The fix was released in Astro 7.2.8, which requires Sharp 0.35.4.

Severity

  • CVSS Score: 9.8 / 10 (Critical)
  • Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

Astro: Authorization bypass from missing path-segment boundary check when stripping the configured base

CVE-2026-84376 / GHSA-376h-93r7-7g6f

More information

Details

Summary

Astro stripped a configured base path from request pathnames using a string-prefix check that did not verify a path-segment boundary. With base: "/app", a request to /appX/admin was treated as being under the base and resolved internally to the /admin route, while middleware still observed the public pathname /appX/admin. Middleware that authorizes routes by inspecting context.url.pathname could therefore be bypassed.

Impact

An unauthenticated remote attacker can bypass pathname-based middleware authorization in applications that:

  • Configure a non-root base.
  • Protect base-prefixed routes in middleware using context.url.pathname.

Because routing and middleware resolved different effective pathnames, a request such as /appX/admin (or other single-character extensions like /app2/admin or /app-/admin) reached the protected /admin route without passing the middleware check that guards /app/admin. Astro's authentication guide demonstrates protecting routes in middleware via context.url.pathname, so this is a reasonable and expected pattern.

Affected versions

astro <= 7.2.3.

Patches

Fixed in astro 7.2.4. Base stripping now requires the pathname to equal the base without its trailing slash, or to be followed by a /, so a prefix that does not end on a path-segment boundary is no longer treated as being under the base. Routing and context.url.pathname now resolve the same pathname.

Workarounds

Upgrade to astro 7.2.4 or later. As a mitigation before upgrading, avoid relying solely on prefix checks of context.url.pathname for authorization, or reject requests whose pathname does not begin with the configured base followed by a path-segment boundary.

Credits

Reported by @​Ryoga-exe.

Severity

  • CVSS Score: 6.3 / 10 (Medium)
  • Vector String: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

References

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

Release Notes

withastro/astro (astro)

v7.2.8

Compare Source

Patch Changes

v7.2.7

Compare Source

Patch Changes

v7.2.6

Compare Source

Patch Changes
  • #​17812 29af6da Thanks @​matthewp! - Fixes a bug where new FetchState(request) could fail in development when server dependencies were optimized

v7.2.5

Compare Source

Patch Changes

  • #​17758 5f419e2 Thanks @​astro-factory! - Fixes a bug where experimental_getFontFileURL() rejected valid font URLs when using the Cloudflare adapter

  • #​17416 493796b Thanks @​iseraph-dev! - Skips no-op pathname writes when normalizing SSR request URLs

  • #​17712 bd374b7 Thanks @​fkatsuhiro! - Updates deprecation messages target from Astro 7 to 8

  • #​17719 dac1768 Thanks @​astrobot-houston! - Fixes session ID validation to reject non-UUID cookie values before using them as storage keys

  • #​17770 84eb7e7 Thanks @​astro-factory! - Fixes --mode, --site, --base, --out-dir, --verbose, --silent, and --open flags being silently dropped when using astro dev --background or astro preview --background

  • #​17713 d035290 Thanks @​wakqasahmed! - Fixes content-modules.mjs not removing entries for deleted or renamed content files, which could cause Vite to attempt to resolve non-existent modules

    As part of this fix, #moduleImports is now fully rebuilt from deferredRender entries before every write, so a module import added only through the public addModuleImport() API without a corresponding deferredRender entry in the store will no longer be preserved across writes.

  • #​17743 adc750f Thanks @​contactjawad! - Fixes Astro.preferredLocale and Astro.preferredLocaleList ignoring Accept-Language quality values when they are absent or 0. An entry without an explicit q= now correctly counts as quality 1.0 (per RFC 7231) and an entry with q=0 is treated as not acceptable, so the highest-quality locale is selected regardless of header order.

  • #​17757 660991c Thanks @​astro-factory! - Fixes build errors showing wrong file location, missing line:col, and misleading hints when a plugin error (e.g. from MDX) is wrapped by Vite's build error

  • #​17783 60b14ff Thanks @​matthewp! - Fixes a type error when passing an image from a content collection image() schema to a component or <Image />. The schema returned by image() was missing the apng format, so it no longer matched the type of an imported image.

  • #​17664 d483125 Thanks @​astrobot-houston! - Fixes an issue where Astro CSP support didn't correctly handle cases "unsafe-inline" resource. Now when "unsafe-inline", Astro won't emit hashes for the directive specified.

  • #​17810 0fc5f65 Thanks @​florian-lefebvre! - Fixes a regression in the content collections that could cause images to not be resolved

  • #​17781 aa33b44 Thanks @​matthewp! - Fixes memoryCache() storing responses that set cookies through Astro.cookies or Astro.session

  • #​17787 6661fbe Thanks @​astro-factory! - Fixes server:defer crashing the dev server with "undefined is not a function" when a deferred component imports from astro:i18n

  • #​17750 dd0e3ac Thanks @​dobrodob! - Fixes a regression where transition:persist stopped working for <audio> and <video> elements.

  • #​17774 fe1d16d Thanks @​astro-factory! - Adds support for importing .apng files as image metadata for use with standard <img> elements. Astro's image components reject APNG files to avoid removing their animation

  • #​17799 8797754 Thanks @​astro-factory! - Fixes i18n fallbackType: "rewrite" returning 500 instead of 404 when the fallback locale also has no matching static path for a prerendered dynamic route

  • #​17741 99d3d3d Thanks @​ericswpark! - Bumps the Astro compiler to the latest version. Changelog.

  • #​17782 3578d45 Thanks @​Princesseuh! - Improves the performance of the Astro CLI in local by enabling Node's module compilation cache.

  • #​17705 2043e4f Thanks @​astrobot-houston! - Fixes incremental builds serving cached HTML that references stale CSS filenames after a stylesheet-only edit

  • #​17754 3d50dfd Thanks @​astro-factory! - Fixes the dev server refusing to start in Docker containers after a restart due to PID reuse in the lock file check

  • #​17769 bbda94d Thanks @​astro-factory! - Fixes a build failure when defining vite.environments.ssr in the Astro config. User-provided environment config for ssr, prerender, or client is now properly deep-merged with Astro's internal environment settings instead of silently breaking the server entry naming.

  • #​17776 0874da8 Thanks @​astro-factory! - Fixes the glob() content loader failing to load files with colons in their names (e.g., Guide: Architecture.md)

  • Updated dependencies [0762a83, 0c99615]:

v7.2.4

Compare Source

Patch Changes

v7.2.3

Compare Source

Patch Changes

  • #​17724 97140b2 Thanks @​ematipico! - Fixes an issue where Astro could run out of memory when experimental.collectionStorage is set to chunked and there are multiple concurrent updates to the same collection.

  • #​17636 51723b1 Thanks @​matthewp! - Fixes the dev server sometimes matching against stale routes after pages were added, removed, or renamed, requiring a dev server restart to pick up the change

  • #​17636 51723b1 Thanks @​matthewp! - Fixes the composable request helpers (astro/fetch) throwing an error when used on a request that had been rewritten with Astro.rewrite() or next()

  • #​17636 51723b1 Thanks @​matthewp! - Refactors Astro's internal server-side request handling. This is an internal change: all documented public APIs, including App and NodeApp, keep their existing signatures and behavior.

    The undocumented internal app.pipeline property and the AppPipeline export from astro/app have been removed. Adapters that used app.pipeline.getLogger() to wait for the configured log destination can call the new app.getLogger() instead.

    As a result of this refactor, new FetchState(request) from astro/fetch now works anywhere inside a built Astro server — including custom src/fetch.ts entrypoints — without the request needing to first pass through app.render(). Previously this threw an error, breaking patterns like the Cloudflare adapter's advanced custom-worker setup.

  • #​17723 c3b9aed Thanks @​florian-lefebvre! - Fixes a link in font providers JSDoc annotations

  • #​17699 e28d227 Thanks @​ArmandPhilippot! - Fixes several documentation issues related to the JSDoc for configuration options.

    • When hovering over the server and fonts options, the JSDoc for the nested options was displayed instead of the JSDoc for the top-level property.
    • Two i18n configuration options were being used incorrectly in the examples.
    • The indentation of some code blocks was broken on hover.

  • #​17572 2066f39 Thanks @​matthewp! - Fixes a crash when a request arrives with a malformed port in the Host header (for example example.com:65536 or example.com:8080:8080). Such a host made the constructed request URL invalid, and the fallback that was meant to recover reused the same invalid host and threw again. The request URL now degrades to a host the server controls when the incoming host cannot be parsed, so the request is handled instead of erroring.

  • #​17685 9f15609 Thanks @​astrobot-houston! - Fixes a dev server error where an SSR full reload triggered by a third-party Vite plugin (such as @tailwindcss/vite) could fail with Failed to load url astro:server-app.js

  • #​17636 51723b1 Thanks @​matthewp! - Improves error handling for custom log destinations. When the configured logger fails to load, Astro now reports the error and continues with the default console logger instead of failing the first request.

  • #​17631 cf29bec Thanks @​matthewp! - Fixes getCollection() and getEntry() throwing DataCloneError when a collection schema transform returns a Temporal.PlainDate or other class instance.

  • Updated dependencies [8c193f6]:

Configuration

📅 Schedule: (UTC)

  • Branch creation
    • At any time (no schedule defined)
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

@renovate renovate Bot added the security label Sep 10, 2026
@cloudflare-workers-and-pages

cloudflare-workers-and-pages Bot commented Sep 10, 2026

Copy link
Copy Markdown
Contributor

Deploying site with  Cloudflare Pages  Cloudflare Pages

Latest commit: c9fc910
Status: ✅  Deploy successful!
Preview URL: https://aab38271.site-7lj.pages.dev
Branch Preview URL: https://renovate-npm-astro-vulnerabi.site-7lj.pages.dev

View logs

@renovate renovate Bot changed the title Update dependency astro to v7.2.8 [SECURITY] Update dependency astro to v7.2.8 [SECURITY] - autoclosed Sep 10, 2026
@renovate renovate Bot closed this Sep 10, 2026
@renovate
renovate Bot deleted the renovate/npm-astro-vulnerability branch September 10, 2026 22:22
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

security

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants