high · 8.2CVE-2026-59731Jul 20, 2026

CVE-2026-59731: Astro Middleware Authorization Bypass via URL Decode Iteration Limit

Shubham Kandhare
Security Engagement Manager, SecureLayer7

A specially over-encoded URL path lets an attacker slip past Astro middleware access checks and reach protected routes, because middleware and the router decode the path a different number of times an

Packageastro
Ecosystemnpm
Affected>= 6.4.7, < 6.4.8
Fixed in6.4.8

The problem

Astro 6.4.7 introduced an iterative URL decoder (PR #16967) that runs at most 10 decode passes before handing the pathname to middleware. The problem is that when the cap is hit, the partially decoded value is returned rather than the request being rejected.

The router then runs one more independent `decodeURI()` call during route matching. Middleware sees a non-canonical path and allows the request; the router resolves it to the protected route. Any middleware doing path-based authorization with `context.url.pathname` followed by `next(context.url)` is affected.

Proof of concept

A working proof-of-concept for CVE-2026-59731 in astro, with the exact payload below.

bash
curl -i http://127.0.0.1:8989/%252525252525252525252561dmin

Encoding `a` as `%61` and then percent-encoding the `%` sign eleven times deep produces `%252525252525252525252561dmin`. The 6.4.7 decoder stops after 10 iterations and returns `/%61dmin` to middleware. Middleware sees a path that does not equal `/admin`, so it calls `next(context.url)`.

The router then calls `decodeURI('/%61dmin')` one more time, resolving to `/admin` and serving the protected page.

The root cause is CWE-647: authorization and routing operate on different canonical representations of the same path. The patch (commit 27c80ea, PR #17109) hardens the iteration limit so that paths still containing percent-encoded sequences after the cap are rejected rather than forwarded in a partially decoded state.

The fix

Upgrade to astro@6.4.8. The fix (commit 27c80ea by @ematipico) hardens the URL decoding limit so that a pathname that has not fully stabilized by the iteration cap is rejected, eliminating the mismatch between middleware and router canonicalization. No API changes.

Reporter not attributed.

References: [1][2][3][4][5][6]

Related research