CVE-2026-59731: Astro Auth Bypass Vulnerability

CVE-2026-59731 Overview

CVE-2026-59731 is an authorization bypass vulnerability in the Astro web framework affecting version 6.4.7. The framework performs authorization decisions on a partially decoded pathname after reaching the iterative URL decoder limit. A later rewrite route-matching stage performs an additional decodeURI() operation, which can resolve the request to a protected route that authorization already cleared. This inconsistency between the authorization path and the routing path allows attackers to reach protected routes using multi-level URL encoding. The issue is classified under [CWE-647: Use of Non-Canonical URL Paths for Authorization Decisions] and is fixed in version 6.4.8.

Critical Impact
Unauthenticated network attackers can bypass authorization controls and access protected routes by crafting URLs with multiple layers of percent-encoding.

Affected Products

Astro web framework version 6.4.7
Applications built on Astro 6.4.7 relying on route-based authorization
Astro deployments using i18n and rewrite handlers prior to 6.4.8

Discovery Timeline

2026-07-08 - CVE-2026-59731 published to NVD
2026-07-08 - Last updated in NVD database

Technical Details for CVE-2026-59731

Vulnerability Analysis

Astro applies an iterative URL decoder to incoming request pathnames before making authorization decisions. When the input exceeds the decoder's iteration limit, the pathname remains partially encoded at the point authorization runs. Later in the request lifecycle, the rewrite route-matching logic invokes decodeURI() one more time. That extra decoding step can transform the partially encoded path into a canonical form that matches a protected route the authorization layer never evaluated against its true value.

The result is a canonicalization mismatch. Authorization sees one string, and routing sees another. Attackers exploit this gap by chaining percent-encoding layers so that the value observed by the guard differs from the value ultimately used to select the handler.

Root Cause

The root cause is inconsistent path normalization across security-relevant stages. Authorization operates on a non-canonical pathname while routing continues to decode. This violates the principle that authorization decisions must be made on the fully canonicalized resource identifier used for dispatch.

Attack Vector

Exploitation requires only a crafted HTTP request over the network with no authentication or user interaction. An attacker constructs a URL that contains enough encoding layers to exhaust the iterative decoder before authorization runs, then relies on the additional decodeURI() call in the rewrite handler to expose a protected route.

typescript

// Security patch from packages/astro/src/core/fetch/fetch-state.ts
 import { Rewrites } from '../rewrites/handler.js';
 import { isRoute404or500, isRouteServerIsland } from '../routing/match.js';
 import { normalizeUrl } from '../util/normalized-url.js';
-import { validateAndDecodePathname } from '../util/pathname.js';
+import { MultiLevelEncodingError, validateAndDecodePathname } from '../util/pathname.js';
 import { getOriginPathname, setOriginPathname } from '../routing/rewrite.js';
 import { computePathnameFromDomain } from '../i18n/domain.js';
 import { getCustom404Route, routeHasHtmlExtension } from '../routing/helpers.js';

// Security patch from packages/astro/src/core/i18n/handler.ts
-		const url = new URL(state.request.url);
+		// Use Astro's already-decoded URL (`state.url`) instead of reading the
+		// raw request URL again, so locale checks use the same path as routing.
+		const url = state.url;

Source: GitHub Commit 27c80ea

The patch introduces a MultiLevelEncodingError so requests that exceed the decoder limit are rejected instead of being handed off partially decoded. It also aligns the i18n handler with the already-decoded state.url, ensuring locale checks operate on the same path used by routing.

Detection Methods for CVE-2026-59731

Indicators of Compromise

HTTP request URIs containing multiple layers of percent-encoding, such as %25 sequences resolving to % on repeated decoding
Access log entries where a request path with nested encodings resolves to a protected route without a corresponding authentication event
Unexpected 200 responses on admin, private, or authenticated endpoints from unauthenticated source IPs
Requests exercising rewrite or i18n locale prefixes combined with heavy URL encoding

Detection Strategies

Inspect web access logs for pathnames containing three or more nested percent-encoded byte sequences targeting the Astro application
Correlate authorization decision logs with the final routed handler and flag mismatches where the decoded path differs from the authorized path
Deploy web application firewall rules that normalize URLs before inspection and block requests exceeding a reasonable decoding depth

Monitoring Recommendations

Alert on access to sensitive routes when the request pathname contained encoded characters at ingress
Track the Astro application version in asset inventory and flag any instances still running 6.4.7 or earlier
Baseline normal encoding patterns in traffic and alert on outliers targeting protected paths

How to Mitigate CVE-2026-59731

Immediate Actions Required

Upgrade Astro to version 6.4.8 or later across all environments hosting affected applications
Audit access logs for suspicious multi-encoded requests to protected routes since deploying Astro 6.4.7
Rotate any credentials or session tokens that could have been exposed through unauthorized route access
Rebuild and redeploy production artifacts after upgrading to ensure the patched framework is bundled

Patch Information

The fix is available in Astro 6.4.8. See the GitHub Security Advisory GHSA-vj59-8hwv-xxmv, the GitHub Pull Request #17109, and the Astro 6.4.8 Release Notes. The patch rejects requests that exceed the iterative decoder limit and unifies pathname handling between authorization, i18n, and routing stages.

Workarounds

Place a reverse proxy or WAF in front of the Astro application to reject requests containing more than one layer of percent-encoding on path segments
Add middleware that canonicalizes the pathname with a full decode-and-validate pass before authorization logic runs
Restrict access to protected routes at the network layer where feasible until the upgrade to 6.4.8 is complete

bash

# Upgrade Astro to the patched release
npm install astro@6.4.8

# Verify the installed version
npx astro --version