CVE-2026-59731

The record

Astro is a web framework for content-driven websites. Version 6.4.7 performs authorization decisions on a partially decoded pathname after reaching the iterative URL decoder limit, while later rewrite route matching performs an additional decodeURI() operation and can resolve the request to a protected route. This issue is fixed in version 6.4.8.

Affected packages

Related vulnerabilities

• CVE-2026-80515 In Eclipse Arrowhead versions from 5.0.0 to 5.2.1 the management-authorization gate that… CWE-647
• CVE-2026-15970 Consul Community Edition and Consul Enterprise 1.20.1 through 2.0.2 are vulnerable to an… CWE-647
• CVE-2026-8384 In Eclipse Jetty, an HTTP URI of this form: /public;/../admin/secret.txt results in an… CWE-647
• CVE-2026-5222 Cargo between 1.68 and 1.96 incorrectly normalized the URLs of third-party registries… CWE-647
• CVE-2025-9909 A flaw was found in the Red Hat Ansible Automation Platform Gateway route creation… CWE-647
• CVE-2025-66202 Astro has an Authentication Bypass via Double URL Encoding, a bypass for CVE-2025-64765 CWE-647
• GHSA-whqg-ppgf-wp8c Astro has an Authentication Bypass via Double URL Encoding, a bypass for CVE-2025-64765 CWE-647
• CVE-2025-64500 Symfony's incorrect parsing of PATH_INFO can lead to limited authorization bypass CWE-647