CVE-2026-73423

The vulnerability in CVE-2026-73423 is not a missing security check but a compositional architecture that makes security dependent on correct mounting order. The `checkOrigin` middleware was implemented correctly — the failure is that it must be mounted before handlers that dispatch to user code, and this ordering requirement was invisible to developers using Astro's composable primitives. When Astro 7.0 extracted `actions()` and `pages()` as standalone primitives from the opinionated `astro()` pipeline, the security primitive was not extracted with them. This is the critical detail: the vulnerability was not inherited from Hono's pattern — it was re-introduced during the 7.0 refactor. The security model existed in earlier versions but was forgotten during the architectural extraction. The official `examples/advanced-routing` demonstrated the vulnerable mounting order, meaning developers following Astro's own materials were actively modeled into the vulnerability. The CVSS 5.1 rating is defensible for the technical finding but undersells actual risk. The write-only CSRF characterization assumes the attacker cannot read responses — but they can trigger `ActionHandler.handle` with victim credentials. Whether this matters depends on what the actions do. Content-driven sites with user accounts — Astro's core audience — are disproportionately likely to have action handlers that send emails, modify subscriptions, or call third-party APIs. Blind CSRF against high-privilege operations is consequential regardless of response unreadability. The critical uncertainty is whether 7.0.6 enforces `checkOrigin` at the handler dispatch layer regardless of mounting order, or merely corrects the documented example ordering. If it's the latter, the composable API remains fundamentally unsafe for security-sensitive deployments — any developer who writes custom routing and places a handler before `middleware()` in the mounting chain recreates the vulnerability without touching the security logic. A genuine fix would make `checkOrigin` an explicit, non-optional option on `actions()` and `pages()` that defaults to enabled, not an inherited middleware behavior dependent on ordering. If you deployed Astro 7.0.0–7.0.5 with custom routing following official examples, audit your mounting chain. Verify that `middleware()` containing `checkOrigin` is mounted before any handler that dispatches to action or page handlers. Until Astro enforces this at the dispatch layer, your application security depends on ordering discipline the framework makes invisible.

Reviewed through automated stages and approved by a human before publication.