Executive brief
Astro is a JavaScript framework used to build fast web applications. A flaw in how Astro processes URL paths allows attackers to bypass authentication checks in middleware by using URL-encoded characters (e.g., %61 for 'a'). An attacker can reach protected routes like /admin by crafting requests with encoded paths that the routing system decodes but the authentication checks do not, leading to unauthorized access to administrative or sensitive functionality.
Technical details
The vulnerability is a path normalization bypass (CWE-22) in Astro's middleware handling. Astro internally decodes URL paths using decodeURI() before routing requests to the correct page, but the middleware context.url.pathname is not similarly decoded. This creates a mismatch: an attacker sending GET /%61dmin (where %61 is the URL encoding of 'a') will be routed to /admin internally but fail middleware authentication checks that compare against the undecoded path string. The attacker gains access to protected routes without meeting authentication requirements. The fix applies decodeURI() consistently to the path before passing it to middleware context. Affected versions are all releases before 5.15.8, which includes the patch.
Affected products
- Astro Astro < 5.15.8
Timeline
- 2025-11-19: disclosed
- 2025-11-19: patched: Fixed in version 5.15.8
- 2025-02-04: other: Advisory modified on GitHub