# CVE-2026-59731: withastro Astro authorization bypass via URL decoding mismatch

Source: https://junglewise.ai/threats/cve-2026-59731-withastro-astro-authorization-bypass-via-url-decoding-mismatch  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-08. Updated: 2026-07-20  
License: CC BY 4.0 with a link back

CVE-2026-59731 · Severity: high · CVSS 8.2 · Published 2026-07-08

Astro is a popular web framework used to build fast websites. A security flaw in how it handles web addresses (URLs) allows attackers to bypass security rules that protect sensitive areas like admin dashboards or private APIs. By specially crafting a URL with many layers of encoding, an attacker can trick the security system into thinking the request is safe while the internal router still sends them to a protected page.

Technologies: [astro (npm)](https://junglewise.ai/threats/technologies/astro). Vendors: [npm](https://junglewise.ai/threats/vendors/npm).

## Quick answers

**Is CVE-2026-59731 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-59731 being exploited in the wild.

**How severe is CVE-2026-59731?** High severity, with a CVSS score of 8.2, published 8 July 2026.

**Which products and versions are affected?** astro (npm) >= 6.4.7, < 6.4.8, SEMVER:introduced=6.4.7,fixed=6.4.8.

**Is there a fix for CVE-2026-59731?** Yes. astro (npm): upgrade to 6.4.8 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-59731 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-59731?** Check whether you run astro (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- astro (npm): upgrade to 6.4.8 or later

  ```sh
  npm install astro@6.4.8
  ```


## Technical details

Astro 6.4.7 introduced iterative URI decoding with a maximum cap of 10 iterations. If a URL is encoded more than 10 times (e.g., depth 11), the middleware receives a partially decoded string, while the subsequent route matching logic performs an additional decodeURI() call. This canonicalization mismatch (CWE-647) allows an attacker to bypass path-based authorization checks in middleware and reach protected routes. The vulnerability is exploitable when applications use path-based authorization and rewrite-based routing (next(context.url)). The issue is resolved in version 6.4.8 by rejecting requests that exceed the decoding iteration limit.

## Affected products

- withastro Astro >= 6.4.7, < 6.4.8

## Identifiers

- CVE-2026-59731
- GHSA-vj59-8hwv-xxmv

## Timeline

- 2026-07-01: disclosed
- 2026-07-01: patched: Fixed in version 6.4.8
- 2026-07-20: advisory

## References

- [https://api.github.com/users/Eclso](https://api.github.com/users/Eclso)
- [https://github.com/Eclso](https://github.com/Eclso)
- [https://api.github.com/users/Eclso/gists%7B/gist_id%7D](https://api.github.com/users/Eclso/gists%7B/gist_id%7D)
- [https://api.github.com/users/Eclso/repos](https://api.github.com/users/Eclso/repos)
- [https://avatars.githubusercontent.com/u/91365965?v=4](https://avatars.githubusercontent.com/u/91365965?v=4)
- [https://api.github.com/users/Eclso/events%7B/privacy%7D](https://api.github.com/users/Eclso/events%7B/privacy%7D)

## Related threats

- [Astro HTML injection in script and style element rendering](https://junglewise.ai/threats/cve-2026-114128-astro-is-a-web-framework-for-content-driven-websites-prior-to-7)
- [Astro CSS injection in View Transition animation values](https://junglewise.ai/threats/cve-2026-114127-astro-is-a-web-framework-for-content-driven-websites-from-7-1-0)
- [Astro remote code execution via AVIF image processing](https://junglewise.ai/threats/astro-remote-code-execution-via-avif-image-processing-6b99ffe8)
- [Astro authorization bypass in base path stripping](https://junglewise.ai/threats/cve-2026-84376-astro-authorization-bypass-in-base-path-stripping)
- [Astro composable astro/hono pipeline CSRF via origin check bypass](https://junglewise.ai/threats/cve-2026-73423-astro-composable-astro-hono-pipeline-csrf-via-origin-check-bypass)