CVE-2025-64765
Medium · 5.3Astro's middleware authentication checks based on url.pathname can be bypassed via url encoded values
CVSS
5.3
EPSS
0.5%
Published
Nov 19, 2025
CISA due date
—
The record
A mismatch exists between how Astro normalizes request paths for routing/rendering and how the application’s middleware reads the path for validation checks. Astro internally applies `decodeURI()` to determine which route to render, while the middleware uses `context.url.pathname` without applying the same normalization (decodeURI). This discrepancy may allow attackers to reach protected routes (e.g., /admin) using encoded path variants that pass routing but bypass validation checks.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| npm | astro | 0 | 5.15.8 |
Related vulnerabilities
- GHSA-ggxq-hp9w-j794 Astro's middleware authentication checks based on url.pathname can be bypassed via url… Same vulnerability
- CVE-2026-54298 Astro is a web framework. Also affects astro
- CVE-2026-54299 Astro is a web framework. Also affects astro
- CVE-2026-50146 Astro is a web framework. Also affects astro
- GHSA-jrpj-wcv7-9fh9 Astro: XSS via Unescaped Attribute Names in Spread Props Also affects astro
- GHSA-2pvr-wf23-7pc7 Astro: Host header SSRF in prerendered error page fetch Also affects astro
- GHSA-8hv8-536x-4wqp Astro: Reflected XSS via unescaped slot name Also affects astro
- CVE-2026-45028 Astro is a web framework. Also affects astro