CVE-2025-64765
published 2025-11-19CVE-2025-64765: Astro is a web framework. Prior to version 5.15.8, a mismatch exists between how Astro normalizes request paths for routing/rendering and how the application’s…
PriorityP431medium5.3CVSS 3.1
AVNACLPRNUINSUCLINAN
EPSS
0.47%
37.2th percentile
Astro is a web framework. Prior to version 5.15.8, a mismatch exists between how Astro normalizes request paths for routing/rendering and how the application’s middleware reads the path for validation checks. Astro internally applies decodeURI() to determine which route to render, while the middleware uses context.url.pathname without applying the same normalization (decodeURI). This discrepancy may allow attackers to reach protected routes using encoded path variants that pass routing but bypass validation checks. This issue has been patched in version 5.15.8.
Affected
3 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| astro | astro | < 5.15.8 | 5.15.8 |
| astro | astro | >= 0 < 5.15.8 | 5.15.8 |
| withastro | astro | < 5.15.8 | 5.15.8 |
CVSS provenance
nvdv3.15.3MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
nvdv4.06.9MEDIUMCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
ghsa6.9MEDIUM
osv6.9MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
Astro has an Authentication Bypass via Double URL Encoding, a bypass for CVE-2025-64765
ghsa·2025-12-08·CVSS 6.9
CVE-2025-66202 [MEDIUM] CWE-647 Astro has an Authentication Bypass via Double URL Encoding, a bypass for CVE-2025-64765
Astro has an Authentication Bypass via Double URL Encoding, a bypass for CVE-2025-64765
# Authentication Bypass via Double URL Encoding in Astro
## Bypass for CVE-2025-64765 / GHSA-ggxq-hp9w-j794
---
### Summary
A **double URL encoding bypass** allows any unauthenticated attacker to bypass path-based authentication checks in Astro middleware, granting unauthorized access to protected routes. While the original CVE-2025-64765 (single URL encoding) was fixed in v5.15.8, the fix is insufficient as it only decodes once. By using double-encoded URLs like `/%2561dmin` instead of `/%61dmin`, attackers can still bypass authentication and access protected resources such as `/admin`, `/api/internal`, or any route protected by middleware pathname checks.
## Fix
A more secure fix is just decodi
OSV
Astro has an Authentication Bypass via Double URL Encoding, a bypass for CVE-2025-64765
osv·2025-12-08·CVSS 6.9
CVE-2025-66202 [MEDIUM] Astro has an Authentication Bypass via Double URL Encoding, a bypass for CVE-2025-64765
Astro has an Authentication Bypass via Double URL Encoding, a bypass for CVE-2025-64765
# Authentication Bypass via Double URL Encoding in Astro
## Bypass for CVE-2025-64765 / GHSA-ggxq-hp9w-j794
---
### Summary
A **double URL encoding bypass** allows any unauthenticated attacker to bypass path-based authentication checks in Astro middleware, granting unauthorized access to protected routes. While the original CVE-2025-64765 (single URL encoding) was fixed in v5.15.8, the fix is insufficient as it only decodes once. By using double-encoded URLs like `/%2561dmin` instead of `/%61dmin`, attackers can still bypass authentication and access protected resources such as `/admin`, `/api/internal`, or any route protected by middleware pathname checks.
## Fix
A more secure fix is just decodi
OSV
Astro's middleware authentication checks based on url.pathname can be bypassed via url encoded values
osv·2025-11-19
CVE-2025-64765 [MEDIUM] Astro's middleware authentication checks based on url.pathname can be bypassed via url encoded values
Astro's middleware authentication checks based on url.pathname can be bypassed via url encoded values
A mismatch exists between how Astro normalizes request paths for routing/rendering and how the application’s middleware reads the path for validation checks. Astro internally applies `decodeURI()` to determine which route to render, while the middleware uses `context.url.pathname` without applying the same normalization (decodeURI).
This discrepancy may allow attackers to reach protected routes (e.g., /admin) using encoded path variants that pass routing but bypass validation checks.
https://github.com/withastro/astro/blob/ebc4b1cde82c76076d5d673b5b70f94be2c066f3/packages/astro/src/vite-plugin-astro-server/request.ts#L40-L44
```js
/** The main logic to route dev server requests to page
GHSA
Astro's middleware authentication checks based on url.pathname can be bypassed via url encoded values
ghsa·2025-11-19
CVE-2025-64765 [MEDIUM] CWE-22 Astro's middleware authentication checks based on url.pathname can be bypassed via url encoded values
Astro's middleware authentication checks based on url.pathname can be bypassed via url encoded values
A mismatch exists between how Astro normalizes request paths for routing/rendering and how the application’s middleware reads the path for validation checks. Astro internally applies `decodeURI()` to determine which route to render, while the middleware uses `context.url.pathname` without applying the same normalization (decodeURI).
This discrepancy may allow attackers to reach protected routes (e.g., /admin) using encoded path variants that pass routing but bypass validation checks.
https://github.com/withastro/astro/blob/ebc4b1cde82c76076d5d673b5b70f94be2c066f3/packages/astro/src/vite-plugin-astro-server/request.ts#L40-L44
```js
/** The main logic to route dev server requests to page
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2025-11-19
Published