Executive brief
Astro is a popular web framework used to build fast websites. A security flaw in how it handles web addresses (URLs) allows attackers to bypass security rules that protect sensitive areas like admin dashboards or private APIs. By specially crafting a URL with many layers of encoding, an attacker can trick the security system into thinking the request is safe while the internal router still sends them to a protected page.
Technical details
Astro 6.4.7 introduced iterative URI decoding with a maximum cap of 10 iterations. If a URL is encoded more than 10 times (e.g., depth 11), the middleware receives a partially decoded string, while the subsequent route matching logic performs an additional decodeURI() call. This canonicalization mismatch (CWE-647) allows an attacker to bypass path-based authorization checks in middleware and reach protected routes. The vulnerability is exploitable when applications use path-based authorization and rewrite-based routing (next(context.url)). The issue is resolved in version 6.4.8 by rejecting requests that exceed the decoding iteration limit.
Affected products
- withastro Astro >= 6.4.7, < 6.4.8
Timeline
- 2026-07-01: disclosed
- 2026-07-01: patched: Fixed in version 6.4.8
- 2026-07-20: advisory