What’s Vulnerable › Vulnerabilities

CVE-2026-59731: Astro 6.4.7 Authorization Bypass via Decode Iteration Limit and Rewrite Path Canonicalization Mismatch

• Severity: high (CVSS 8.2 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.3% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-07-08 · updated 2026-10-25
• Weakness: CWE-647

Description

Astro is a web framework for content-driven websites. Version 6.4.7 performs authorization decisions on a partially decoded pathname after reaching the iterative URL decoder limit, while later rewrite route matching performs an additional decodeURI() operation and can resolve the request to a protected route. This issue is fixed in version 6.4.8.

Affected products

• withastro astro: from 6.4.7, < 6.4.8

References

• https://github.com/withastro/astro/commit/27c80ea92248993e5fce94b2c26d87d611ab6785
• https://github.com/withastro/astro/pull/17109
• https://github.com/withastro/astro/releases/tag/astro@6.4.8
• https://github.com/withastro/astro/security/advisories/GHSA-vj59-8hwv-xxmv
• https://github.com/withastro/astro/security/advisories/GHSA-vj59-8hwv-xxmv

Get alerted when CVE-2026-59731 or the next vulnerability affects your stack