{"id":"CVE-2025-66202","aliases":["AIKIDO-2025-10879","CLSA-2026-1777855417","CLSA-2026-1777855422","CLSA-2026-1777941830","CLSA-2026-1778114666","CLSA-2026-1778633121","CLSA-2026-1792161544","CLSA-2026-1792161545","CLSA-2026-1792161546","CLSA-2026-1792161681","CLSA-2026-1792161682","CLSA-2026-1792161683","CLSA-2026-1792161684","CLSA-2026-1792161686","CLSA-2026-1792161759","CLSA-2026-1792161775","CLSA-2026-1792161776","CLSA-2026-1792161777","CLSA-2026-1792161847","CLSA-2026-1792161848","EUVD-2025-201717","GHSA-whqg-ppgf-wp8c"],"status":"published","title":"Astro has an Authentication Bypass via Double URL Encoding, a bypass for CVE-2025-64765","description":"Astro is a web framework. Versions 5.15.7 and below have a double URL encoding bypass which allows any unauthenticated attacker to bypass path-based authentication checks in Astro middleware, granting unauthorized access to protected routes. While the original CVE-2025-64765 was fixed in v5.15.8, the fix is insufficient as it only decodes once. By using double-encoded URLs, attackers can still bypass authentication and access any route protected by middleware pathname checks. This issue is fixed in version 5.15.8.","severity":{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.00333,"percentile":0.26926,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-647"],"published":"2025-12-08T16:26:43Z","modified":"2026-11-10T19:58:25Z","fixes":[{"ecosystem":"npm","package":"astro","fixed_in":["5.15.8"],"sources":["ghsa","osv"]},{"ecosystem":"TuxCare:npm","package":"@astrojs/internal-helpers","fixed_in":["4.16.19-tuxcare.1"],"sources":["osv"]},{"ecosystem":"TuxCare:npm","package":"@astrojs/studio","fixed_in":["4.16.19-tuxcare.1"],"sources":["osv"]},{"ecosystem":"TuxCare:npm","package":"@astrojs/underscore-redirects","fixed_in":["4.16.19-tuxcare.1"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"npm","package":"astro","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.15.8"}]}]},{"source":"osv","ecosystem":"TuxCare:npm","package":"astro","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.9.2-tuxcare.0"},{"fixed":"1.9.2-tuxcare.1"}]}],"versions":["1.9.2"],"bundled":10},{"source":"osv","ecosystem":"TuxCare:npm","package":"astro","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.26.1-tuxcare.0"},{"fixed":"0.26.1-tuxcare.1"}]}],"versions":["0.26.1"],"bundled":10},{"source":"osv","ecosystem":"TuxCare:npm","package":"astro","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.10.15-tuxcare.0"},{"fixed":"2.10.15-tuxcare.1"}]}],"versions":["2.10.15"],"bundled":10},{"source":"osv","ecosystem":"TuxCare:npm","package":"@astrojs/db","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.16.19-tuxcare.0"},{"fixed":"4.16.19-tuxcare.1"}]}],"versions":["4.16.19"],"bundled":8},{"source":"osv","ecosystem":"TuxCare:npm","package":"@astrojs/rss","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.16.19-tuxcare.0"},{"fixed":"4.16.19-tuxcare.1"}]}],"versions":["4.16.19"],"bundled":8},{"source":"osv","ecosystem":"TuxCare:npm","package":"@astrojs/telemetry","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.16.19-tuxcare.0"},{"fixed":"4.16.19-tuxcare.1"}]}],"versions":["4.16.19"],"bundled":8},{"source":"osv","ecosystem":"TuxCare:npm","package":"astro","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.16.19-tuxcare.0"},{"fixed":"4.16.19-tuxcare.1"}]}],"versions":["4.16.19"],"bundled":8},{"source":"osv","ecosystem":"TuxCare:npm","package":"create-astro","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.16.19-tuxcare.0"},{"fixed":"4.16.19-tuxcare.1"}]}],"versions":["4.16.19"],"bundled":8},{"source":"osv","ecosystem":"TuxCare:npm","package":"astro","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.6.5-tuxcare.0"},{"fixed":"3.6.5-tuxcare.1"}]}],"versions":["3.6.5"],"bundled":11},{"source":"osv","ecosystem":"TuxCare:npm","package":"@astrojs/internal-helpers","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.10.15-tuxcare.0"},{"fixed":"2.10.15-tuxcare.1"}]}],"versions":["2.10.15"],"bundled":11},{"source":"osv","ecosystem":"TuxCare:npm","package":"@astrojs/internal-helpers","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.16.19-tuxcare.0"},{"fixed":"4.16.19-tuxcare.1"}]}],"versions":["4.16.19"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"@astrojs/internal-helpers","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.6.5-tuxcare.0"},{"fixed":"3.6.5-tuxcare.1"}]}],"versions":["3.6.5"],"bundled":13},{"source":"osv","ecosystem":"TuxCare:npm","package":"@astrojs/prism","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.9.2-tuxcare.0"},{"fixed":"1.9.2-tuxcare.1"}]}],"versions":["1.9.2"],"bundled":10},{"source":"osv","ecosystem":"TuxCare:npm","package":"@astrojs/prism","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.26.1-tuxcare.0"},{"fixed":"0.26.1-tuxcare.1"}]}],"versions":["0.26.1"],"bundled":10},{"source":"osv","ecosystem":"TuxCare:npm","package":"@astrojs/prism","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.10.15-tuxcare.0"},{"fixed":"2.10.15-tuxcare.1"}]}],"versions":["2.10.15"],"bundled":11},{"source":"osv","ecosystem":"TuxCare:npm","package":"@astrojs/prism","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.16.19-tuxcare.0"},{"fixed":"4.16.19-tuxcare.1"}]}],"versions":["4.16.19"],"bundled":9},{"source":"osv","ecosystem":"TuxCare:npm","package":"@astrojs/prism","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.6.5-tuxcare.0"},{"fixed":"3.6.5-tuxcare.1"}]}],"versions":["3.6.5"],"bundled":13},{"source":"osv","ecosystem":"TuxCare:npm","package":"@astrojs/studio","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.16.19-tuxcare.0"},{"fixed":"4.16.19-tuxcare.1"}]}],"versions":["4.16.19"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"@astrojs/underscore-redirects","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.10.15-tuxcare.0"},{"fixed":"2.10.15-tuxcare.1"}]}],"versions":["2.10.15"],"bundled":11},{"source":"osv","ecosystem":"TuxCare:npm","package":"@astrojs/underscore-redirects","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.16.19-tuxcare.0"},{"fixed":"4.16.19-tuxcare.1"}]}],"versions":["4.16.19"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"@astrojs/underscore-redirects","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.6.5-tuxcare.0"},{"fixed":"3.6.5-tuxcare.1"}]}],"versions":["3.6.5"],"bundled":13},{"source":"osv","ecosystem":"TuxCare:npm","package":"@astrojs/upgrade","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.16.19-tuxcare.0"},{"fixed":"4.16.19-tuxcare.1"}]}],"versions":["4.16.19"],"bundled":9},{"source":"osv","ecosystem":"TuxCare:npm","package":"@astrojs/upgrade","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.6.5-tuxcare.0"},{"fixed":"3.6.5-tuxcare.1"}]}],"versions":["3.6.5"],"bundled":13},{"source":"osv","ecosystem":"npm","package":"astro","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"5.15.8"}]}]}],"products":[{"vendor":"astro","product":"astro"},{"vendor":"withastro","product":"astro"}],"references":[{"url":"https://github.com/withastro/astro/security/advisories/GHSA-whqg-ppgf-wp8c","tags":["x_refsource_CONFIRM","Vendor Advisory","advisory","web"]},{"url":"https://github.com/withastro/astro/security/advisories/GHSA-ggxq-hp9w-j794","tags":["x_refsource_MISC","Not Applicable","advisory","web"]},{"url":"https://github.com/withastro/astro/commit/6f800813516b07bbe12c666a92937525fddb58ce","tags":["x_refsource_MISC","Patch","fix","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-64765","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-66202","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-whqg-ppgf-wp8c"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/66xxx/CVE-2025-66202.json","tags":["advisory"]},{"url":"https://github.com/withastro/astro","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2025-66202","title":"Astro has an Authentication Bypass via Double URL Encoding, a bypass for CVE-2025-64765","description":"Astro is a web framework. Versions 5.15.7 and below have a double URL encoding bypass which allows any unauthenticated attacker to bypass path-based authentication checks in Astro middleware, granting unauthorized access to protected routes. While the original CVE-2025-64765 was fixed in v5.15.8, the fix is insufficient as it only decodes once. By using double-encoded URLs, attackers can still bypass authentication and access any route protected by middleware pathname checks. This issue is fixed in version 5.15.8.","status":"published","published":"2025-12-08T23:41:21.976Z","modified":"2025-12-09T16:04:07.923Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","level":"medium","assessor":"cna"}],"cwes":["CWE-647"],"updated_at":"2026-11-02T14:32:53.157279Z"}],"euvd":[{"id":"EUVD-2025-201717","description":"Astro is a web framework. Versions 5.15.7 and below have a double URL encoding bypass which allows any unauthenticated attacker to bypass path-based authentication checks in Astro middleware, granting unauthorized access to protected routes. While the original CVE-2025-64765 was fixed in v5.15.8, the fix is insufficient as it only decodes once. By using double-encoded URLs, attackers can still bypass authentication and access any route protected by middleware pathname checks. This issue is fixed in version 5.15.8.","status":"published","published":"2025-12-08T23:41:21Z","modified":"2025-12-09T16:04:07Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T19:49:08.049254Z"}],"ghsa":[{"id":"GHSA-whqg-ppgf-wp8c","title":"Astro has an Authentication Bypass via Double URL Encoding, a bypass for CVE-2025-64765","description":"# Authentication Bypass via Double URL Encoding in Astro\n## Bypass for CVE-2025-64765 / GHSA-ggxq-hp9w-j794\n\n---\n\n### Summary\n\nA **double URL encoding bypass** allows any unauthenticated attacker to bypass path-based authentication checks in Astro middleware, granting unauthorized access to protected routes. While the original CVE-2025-64765 (single URL encoding) was fixed in v5.15.8, the fix is insufficient as it only decodes once. By using double-encoded URLs like `/%2561dmin` instead of `/%61dmin`, attackers can still bypass authentication and access protected resources such as `/admin`, `/api/internal`, or any route protected by middleware pathname checks.\n\n\n## Fix \n\nA more secure fix is just decoding once, then if the request has a %xx format, return a 400 error by using something like :\n\n```\nif (containsEncodedCharacters(pathname)) {\n            // Multi-level encoding detected - reject request\n            return new Response(\n                'Bad Request: Multi-level URL encoding is not allowed',\n                {\n                    status: 400,\n                    headers: { 'Content-Type': 'text/plain' }\n                }\n            );\n        }\n```","status":"published","published":"2025-12-08T16:26:43Z","modified":"2025-12-09T16:28:42Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-647"],"updated_at":"2026-11-02T14:39:12.222121Z"}],"nvd":[{"id":"CVE-2025-66202","description":"Astro is a web framework. Versions 5.15.7 and below have a double URL encoding bypass which allows any unauthenticated attacker to bypass path-based authentication checks in Astro middleware, granting unauthorized access to protected routes. While the original CVE-2025-64765 was fixed in v5.15.8, the fix is insufficient as it only decodes once. By using double-encoded URLs, attackers can still bypass authentication and access any route protected by middleware pathname checks. This issue is fixed in version 5.15.8.","status":"published","published":"2025-12-09T00:15:48.977Z","modified":"2026-10-07T20:10:01.97Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","level":"medium","assessor":"secondary"},{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-647"],"updated_at":"2026-11-02T14:11:49.093461Z"}],"osv":[{"id":"CVE-2025-66202","title":"Astro has an Authentication Bypass via Double URL Encoding, a bypass for CVE-2025-64765","description":"Astro is a web framework. Versions 5.15.7 and below have a double URL encoding bypass which allows any unauthenticated attacker to bypass path-based authentication checks in Astro middleware, granting unauthorized access to protected routes. While the original CVE-2025-64765 was fixed in v5.15.8, the fix is insufficient as it only decodes once. By using double-encoded URLs, attackers can still bypass authentication and access any route protected by middleware pathname checks. This issue is fixed in version 5.15.8.","status":"published","published":"2025-12-08T23:41:21.976Z","modified":"2026-10-28T02:31:03.98739528Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-647"],"updated_at":"2026-11-02T15:44:52.202386Z"},{"id":"GHSA-whqg-ppgf-wp8c","title":"Astro has an Authentication Bypass via Double URL Encoding, a bypass for CVE-2025-64765","description":"# Authentication Bypass via Double URL Encoding in Astro\n## Bypass for CVE-2025-64765 / GHSA-ggxq-hp9w-j794\n\n---\n\n### Summary\n\nA **double URL encoding bypass** allows any unauthenticated attacker to bypass path-based authentication checks in Astro middleware, granting unauthorized access to protected routes. While the original CVE-2025-64765 (single URL encoding) was fixed in v5.15.8, the fix is insufficient as it only decodes once. By using double-encoded URLs like `/%2561dmin` instead of `/%61dmin`, attackers can still bypass authentication and access protected resources such as `/admin`, `/api/internal`, or any route protected by middleware pathname checks.\n\n\n## Fix \n\nA more secure fix is just decoding once, then if the request has a %xx format, return a 400 error by using something like :\n\n```\nif (containsEncodedCharacters(pathname)) {\n            // Multi-level encoding detected - reject request\n            return new Response(\n                'Bad Request: Multi-level URL encoding is not allowed',\n                {\n                    status: 400,\n                    headers: { 'Content-Type': 'text/plain' }\n                }\n            );\n        }\n```","status":"published","published":"2025-12-08T16:26:43Z","modified":"2026-02-04T02:27:12.689316Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-647"],"updated_at":"2026-11-02T15:46:58.767335Z"},{"id":"CLSA-2026-1777855417","title":"TuxCare security update for astro (10 CVEs)","description":"TuxCare rebuilt astro to address 10 CVEs. Fixed in 1.9.2-tuxcare.1.","status":"published","published":"2026-08-04T14:52:30Z","modified":"2026-10-30T19:45:54.337273141Z","updated_at":"2026-11-02T15:43:44.384419Z"},{"id":"CLSA-2026-1777855422","title":"TuxCare security update for astro (10 CVEs)","description":"TuxCare rebuilt astro to address 10 CVEs. Fixed in 0.26.1-tuxcare.1.","status":"published","published":"2026-08-04T14:52:30Z","modified":"2026-10-30T19:45:52.829936878Z","updated_at":"2026-11-02T15:43:44.384419Z"},{"id":"CLSA-2026-1777941830","title":"TuxCare security update for astro (10 CVEs)","description":"TuxCare rebuilt astro to address 10 CVEs. Fixed in 2.10.15-tuxcare.1.","status":"published","published":"2026-08-04T14:52:30Z","modified":"2026-10-30T19:45:54.887902642Z","updated_at":"2026-11-02T15:43:44.737408Z"},{"id":"CLSA-2026-1778114666","title":"TuxCare security update for 5 packages (9 CVEs)","description":"TuxCare rebuilt 5 packages to address 9 CVEs. Fixed in 4.16.19-tuxcare.1.","status":"published","published":"2026-08-04T14:52:30Z","modified":"2026-10-25T01:43:07.718699294Z","updated_at":"2026-11-02T15:43:44.737408Z"},{"id":"CLSA-2026-1778633121","title":"TuxCare security update for astro (11 CVEs)","description":"TuxCare rebuilt astro to address 11 CVEs. Fixed in 3.6.5-tuxcare.1.","status":"published","published":"2026-08-04T14:52:31Z","modified":"2026-10-30T19:45:58.685288003Z","updated_at":"2026-11-02T15:43:44.737408Z"},{"id":"CLSA-2026-1792161544","title":"TuxCare security update for @astrojs/internal-helpers (11 CVEs)","description":"TuxCare rebuilt @astrojs/internal-helpers to address 11 CVEs. Fixed in 2.10.15-tuxcare.1.","status":"published","published":"2026-10-16T14:39:04Z","modified":"2026-10-16T16:30:31.972857815Z","updated_at":"2026-11-02T15:43:51.213191Z"},{"id":"CLSA-2026-1792161545","title":"TuxCare security update for @astrojs/internal-helpers (1 CVE)","description":"TuxCare rebuilt @astrojs/internal-helpers to address 1 CVE. Fixed in 4.16.19-tuxcare.1.","status":"published","published":"2026-10-16T14:39:05Z","modified":"2026-11-10T19:58:21.555637658Z","updated_at":"2026-11-10T20:07:25.465481Z"},{"id":"CLSA-2026-1792161546","title":"TuxCare security update for @astrojs/internal-helpers (13 CVEs)","description":"TuxCare rebuilt @astrojs/internal-helpers to address 13 CVEs. Fixed in 3.6.5-tuxcare.1.","status":"published","published":"2026-10-16T14:39:06Z","modified":"2026-10-16T16:30:31.968641871Z","updated_at":"2026-11-02T15:43:51.213191Z"},{"id":"CLSA-2026-1792161681","title":"TuxCare security update for @astrojs/prism (10 CVEs)","description":"TuxCare rebuilt @astrojs/prism to address 10 CVEs. Fixed in 1.9.2-tuxcare.1.","status":"published","published":"2026-10-16T14:41:21Z","modified":"2026-10-16T16:31:07.064396448Z","updated_at":"2026-11-02T15:43:51.213191Z"},{"id":"CLSA-2026-1792161682","title":"TuxCare security update for @astrojs/prism (10 CVEs)","description":"TuxCare rebuilt @astrojs/prism to address 10 CVEs. Fixed in 0.26.1-tuxcare.1.","status":"published","published":"2026-10-16T14:41:22Z","modified":"2026-10-16T16:31:07.119893696Z","updated_at":"2026-11-02T15:43:51.213191Z"},{"id":"CLSA-2026-1792161683","title":"TuxCare security update for @astrojs/prism (11 CVEs)","description":"TuxCare rebuilt @astrojs/prism to address 11 CVEs. Fixed in 2.10.15-tuxcare.1.","status":"published","published":"2026-10-16T14:41:23Z","modified":"2026-10-16T16:31:07.771808672Z","updated_at":"2026-11-02T15:43:51.213191Z"},{"id":"CLSA-2026-1792161684","title":"TuxCare security update for @astrojs/prism (1 CVE)","description":"TuxCare rebuilt @astrojs/prism to address 1 CVE. Fixed in 4.16.19-tuxcare.1.","status":"published","published":"2026-10-16T14:41:24Z","modified":"2026-11-10T19:45:14.046074043Z","updated_at":"2026-11-10T20:12:40.351566Z"},{"id":"CLSA-2026-1792161686","title":"TuxCare security update for @astrojs/prism (13 CVEs)","description":"TuxCare rebuilt @astrojs/prism to address 13 CVEs. Fixed in 3.6.5-tuxcare.1.","status":"published","published":"2026-10-16T14:41:26Z","modified":"2026-10-16T16:31:14.45884769Z","updated_at":"2026-11-02T15:43:51.213191Z"},{"id":"CLSA-2026-1792161759","title":"TuxCare security update for @astrojs/studio (1 CVE)","description":"TuxCare rebuilt @astrojs/studio to address 1 CVE. Fixed in 4.16.19-tuxcare.1.","status":"published","published":"2026-10-16T14:42:39Z","modified":"2026-11-10T19:58:19.388461808Z","updated_at":"2026-11-10T20:07:30.871041Z"},{"id":"CLSA-2026-1792161775","title":"TuxCare security update for @astrojs/underscore-redirects (11 CVEs)","description":"TuxCare rebuilt @astrojs/underscore-redirects to address 11 CVEs. Fixed in 2.10.15-tuxcare.1.","status":"published","published":"2026-10-16T14:42:55Z","modified":"2026-10-16T16:31:29.981829057Z","updated_at":"2026-11-02T15:43:51.213191Z"},{"id":"CLSA-2026-1792161776","title":"TuxCare security update for @astrojs/underscore-redirects (1 CVE)","description":"TuxCare rebuilt @astrojs/underscore-redirects to address 1 CVE. Fixed in 4.16.19-tuxcare.1.","status":"published","published":"2026-10-16T14:42:56Z","modified":"2026-11-10T19:58:25.736497143Z","updated_at":"2026-11-10T20:07:20.748062Z"},{"id":"CLSA-2026-1792161777","title":"TuxCare security update for @astrojs/underscore-redirects (13 CVEs)","description":"TuxCare rebuilt @astrojs/underscore-redirects to address 13 CVEs. Fixed in 3.6.5-tuxcare.1.","status":"published","published":"2026-10-16T14:42:57Z","modified":"2026-10-16T16:31:09.691814468Z","updated_at":"2026-11-02T15:43:51.213191Z"},{"id":"CLSA-2026-1792161847","title":"TuxCare security update for @astrojs/upgrade (1 CVE)","description":"TuxCare rebuilt @astrojs/upgrade to address 1 CVE. Fixed in 4.16.19-tuxcare.1.","status":"published","published":"2026-10-16T14:44:07Z","modified":"2026-11-10T19:45:16.485682082Z","updated_at":"2026-11-10T20:12:40.351566Z"},{"id":"CLSA-2026-1792161848","title":"TuxCare security update for @astrojs/upgrade (13 CVEs)","description":"TuxCare rebuilt @astrojs/upgrade to address 13 CVEs. Fixed in 3.6.5-tuxcare.1.","status":"published","published":"2026-10-16T14:44:08Z","modified":"2026-10-16T16:31:17.844824171Z","updated_at":"2026-11-02T15:43:51.213191Z"}]}}