-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability is an authentication bypass caused by improper handling of double URL-encoded characters in the request path. The provided patch was intended to fix a similar vulnerability (CVE-2025-64765) by decoding the URL pathname once before it is passed to the application's middleware for authorization checks. However, this fix is insufficient.
An attacker can bypass this single-decode mechanism by double-encoding the URL. For example, a request for a protected route like /admin can be sent as /%2561dmin.
RenderContext.#createNormalizedUrl (for production SSR) and handleRequest (for the development server), receive the double-encoded path.decodeURI() once, transforming /%2561dmin into /%61dmin./%61dmin against the protected path /admin, the check fails, and the middleware incorrectly allows the request to proceed./admin, and serves the protected content, resulting in an authentication bypass.The identified functions are the precise locations where this flawed, single-pass decoding occurs, making them the root cause of the vulnerability.
RenderContext.#createNormalizedUrlpackages/astro/src/core/render-context.ts
handleRequestpackages/astro/src/vite-plugin-astro-server/request.ts
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| astro | npm | < 5.15.8 | 5.15.8 |