How severe is CVE-2026-84376?

CVE-2026-84376 has a CVSS 4.0 base score of 6.3, rated medium severity.

Is CVE-2026-84376 being actively exploited?

It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (35th percentile), an estimate of the probability of exploitation in the next 30 days.

How do I fix CVE-2026-84376?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.

When was CVE-2026-84376 published?

CVE-2026-84376 was published on 2026-09-02 and last updated on 2026-09-09.

CVE-2026-84376

CVE-2026-84376 is a medium-severity vulnerability with a CVSS 4.0 base score of 6.3. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-187.

Key facts

Severity: Medium (CVSS 4.0 base score 6.3)
EPSS exploit prediction: 0% (35th percentile)
Actively exploited: Not listed in CISA KEV
Weakness: CWE-187
Published: 2026-09-02
Last modified: 2026-09-09

Description

Astro is a web framework for content-driven websites. Prior to 7.2.4, Astro stripped a configured non-root base path from request pathnames using a string-prefix check without verifying a path-segment boundary. With base "/app", a request to "/appX/admin" resolved internally to the protected "/admin" route while middleware observed "/appX/admin" in context.url.pathname. In applications that authorize base-prefixed routes by inspecting context.url.pathname, an unauthenticated remote attacker could bypass pathname-based middleware authorization and reach protected routes. This issue is fixed in version 7.2.4.

Frequently asked questions

What is CVE-2026-84376?: Astro is a web framework for content-driven websites. Prior to 7.2.4, Astro stripped a configured non-root base path from request pathnames using a string-prefix check without verifying a path-segment boundary. With base "/app", a request to "/appX/admin" resolved internally to the protected "/admin" route while middleware observed "/appX/admin" in context.url.pathname. In applications that authorize base-prefixed routes by inspecting context.url.pathname, an unauthenticated remote attacker could bypass pathname-based middleware authorization and reach protected routes. This issue is fixed in version 7.2.4.
How severe is CVE-2026-84376?: CVE-2026-84376 has a CVSS 4.0 base score of 6.3, rated medium severity.
Is CVE-2026-84376 being actively exploited?: It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (35th percentile), an estimate of the probability of exploitation in the next 30 days.
How do I fix CVE-2026-84376?: Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.
When was CVE-2026-84376 published?: CVE-2026-84376 was published on 2026-09-02 and last updated on 2026-09-09.

References

Other CWE-187 vulnerabilities

CVE-2024-41110 — Critical (CVSS 9.9): Moby is an open-source project created by Docker for software containerization. A security vulnerability has been…
CVE-2022-31802 — Critical (CVSS 9.8): In CODESYS Gateway Server V2 for versions prior to V2.3.9.38 only a part of the the specified password is been compared…
CVE-2026-87853 — High (CVSS 7.5): A flaw was found in SSSD's IdP authentication provider. The eval_access_token_buf() function compares the OIDC subject…
CVE-2026-34785 — High (CVSS 7.5): Rack is a modular Ruby web server interface. Prior to versions 2.2.23, 3.1.21, and 3.2.6, Rack::Static determines…
CVE-2026-62750 — Medium (CVSS 6.5): Partial string comparison in Windows HTTP Protocol Stack allows an unauthorized attacker to perform tampering over an…
CVE-2026-44837 — Medium (CVSS 5.9): view_component is a framework for building reusable, testable, and encapsulated view components in Ruby on Rails. From…

Browse all CWE-187 vulnerabilities →