CVE-2025-66202: Astro Auth Bypass Vulnerability

CVE-2025-66202 Overview

CVE-2025-66202 is an authentication bypass vulnerability in the Astro web framework affecting versions 5.15.7 and earlier. The flaw allows unauthenticated attackers to bypass path-based authentication checks in Astro middleware by using double URL-encoded paths. The original fix for CVE-2025-64765 in version 5.15.8 only decoded the URL once, leaving double-encoded payloads unhandled. Attackers can craft requests whose middleware pathname comparison fails to match protected routes, granting unauthorized access to any route relying on middleware pathname checks. The issue is tracked under CWE-647: Use of Non-Canonical URL Paths for Authorization Decisions and is remediated in Astro 5.15.8.

Critical Impact

Unauthenticated attackers can reach protected application routes by encoding path characters twice, defeating middleware-enforced access control.

Affected Products

• Astro framework versions 5.15.7 and below
• Applications relying on Astro middleware pathname-based authentication
• Node.js deployments of Astro server-side rendered routes

Discovery Timeline

• 2025-12-09 - CVE-2025-66202 published to NVD
• 2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-66202

Vulnerability Analysis

Astro middleware commonly enforces authorization by comparing url.pathname against a list of protected route prefixes. Before the patch, the RenderContext constructor built its URL directly from request.url without normalizing percent-encoded characters. A prior fix (CVE-2025-64765) added a single decodeURI pass, but nested encodings such as %252f still slipped through because one decoding pass produces %2f rather than /. As a result, requests to paths like /admin could be reached through /%2561dmin or similar forms while still resolving to the protected route handler on the server.

Root Cause

The root cause is inconsistent path canonicalization between the middleware pathname comparison layer and the route resolution layer. Middleware saw the encoded form while the router treated the request as the decoded target. This mismatch enables authorization decisions to be made on a non-canonical URL, aligning with CWE-647.

Attack Vector

The vulnerability is exploitable over the network with no authentication or user interaction. An attacker sends an HTTP request containing a double-encoded pathname that targets a middleware-protected route. Because the initial decode leaves an encoded slash or character in place, the middleware pathname check fails to match the protected prefix and the request passes through to the underlying handler.

// Patch: packages/astro/src/core/render-context.ts
// Normalize the URL before middleware sees it
 public clientAddress: string | undefined,
 protected cookies = new AstroCookies(request),
 public params = getParams(routeData, pathname),
-	protected url = new URL(request.url),
+	protected url = RenderContext.#createNormalizedUrl(request.url),
 public props: Props = {},
 public partial: undefined | boolean = undefined,
 public shouldInjectCspMetaTags = !!pipeline.manifest.csp,

Source: withastro/astro commit 6f80081

// Patch: packages/astro/src/vite-plugin-astro-server/request.ts
// Decode the pathname before appending base for SSR
-	url.pathname = removeTrailingForwardSlash(config.base) + url.pathname;
+	url.pathname = removeTrailingForwardSlash(config.base) + decodeURI(url.pathname);

Source: withastro/astro commit 6f80081

Detection Methods for CVE-2025-66202

Indicators of Compromise

• HTTP request logs containing double-encoded path sequences such as %252f, %2561, or %252e targeting known middleware-protected prefixes.
• Successful responses (HTTP 200) for encoded variants of routes that normally return 401 or 302 to a login page.
• Access log entries where the encoded pathname differs from the resolved route handler.

Detection Strategies

• Inspect web server and reverse proxy logs for percent-encoded percent signs (%25) in request paths.
• Compare authenticated session identifiers against requests hitting sensitive routes to spot access without a prior login event.
• Correlate 200 OK responses on protected routes with requests missing expected authentication cookies or headers.

Monitoring Recommendations

• Enable verbose access logging on the Node.js process hosting Astro and forward events to a centralized log platform.
• Add WAF or reverse proxy rules that decode requests before evaluation and alert on multiple encoding passes.
• Baseline traffic patterns for Astro middleware-protected routes and alert on unauthenticated access anomalies.

How to Mitigate CVE-2025-66202

Immediate Actions Required

• Upgrade Astro to version 5.15.8 or later across all environments serving SSR routes.
• Audit middleware source for authorization logic that compares url.pathname against static route prefixes.
• Review recent access logs for double-encoded requests to protected routes and revoke any suspicious sessions.

Patch Information

The fix is delivered in Astro 5.15.8 via commit 6f800813. It normalizes the URL used by RenderContext and applies decodeURI to the pathname before SSR handling. Refer to the GitHub Security Advisory GHSA-whqg-ppgf-wp8c and GHSA-ggxq-hp9w-j794 for advisory details.

Workarounds

• Decode the request pathname explicitly within middleware using decodeURIComponent in a loop until the value stabilizes, then compare against protected prefixes.
• Reject requests containing %25 sequences in the path at the reverse proxy or CDN layer until the patch is deployed.
• Enforce authorization checks inside route handlers as defense in depth, not solely in middleware pathname matchers.

# Upgrade Astro to the patched release
npm install astro@5.15.8

# Verify the installed version
npm ls astro