Astro is a web framework. Prior to version 5.15.8, a mismatch exists between how Astro normalizes request paths for routing/rendering and how the application’s middleware reads the path for validation checks. Astro internally applies decodeURI() to determine which route to render, while the middleware uses context.url.pathname without applying the same normalization (decodeURI). This discrepancy may allow attackers to reach protected routes using encoded path variants that pass routing but bypass validation checks. This issue has been patched in version 5.15.8.

Metrics

Attack Vector Network

Attack Complexity Low

Privileges Required None

Attack Requirements None

User Interaction None

Vulnerable System Confidentiality Impact Low

Vulnerable System Integrity Impact None

Vulnerable System Availability Impact None

Subsequent System Confidentiality Impact None

Subsequent System Integrity Impact None

Subsequent System Availability Impact None

No CVSS v3.1

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00052.

Exploitation none

Automatable yes

Technical Impact partial

Affected Vendors & Products

No data.

No data.

No data.

No data.

Advisories
Source ID Title
Github GHSA Github GHSA GHSA-ggxq-hp9w-j794 Astro's middleware authentication checks based on url.pathname can be bypassed via url encoded values
Fixes

Solution

No solution given by the vendor.

Workaround

No workaround given by the vendor.

References
Link Providers
https://github.com/withastro/astro/commit/6f800813516b07bbe12c666a92937525fddb58ce cve-icon cve-icon
https://github.com/withastro/astro/security/advisories/GHSA-ggxq-hp9w-j794 cve-icon cve-icon
History

Thu, 20 Nov 2025 16:15:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

 ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Wed, 19 Nov 2025 21:15:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Wed, 19 Nov 2025 17:00:00 +0000

Type Values Removed Values Added
Description Astro is a web framework. Prior to version 5.15.8, a mismatch exists between how Astro normalizes request paths for routing/rendering and how the application’s middleware reads the path for validation checks. Astro internally applies decodeURI() to determine which route to render, while the middleware uses context.url.pathname without applying the same normalization (decodeURI). This discrepancy may allow attackers to reach protected routes using encoded path variants that pass routing but bypass validation checks. This issue has been patched in version 5.15.8.
Title Astro middleware authentication checks based on url.pathname can be bypassed via url encoded values
Weaknesses CWE-22
References
Metrics cvssV4_0

{'score': 6.9, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N'}
cve-icon MITRE

Status: PUBLISHED

Assigner: GitHub_M

Published:

Updated: 2025-11-20T15:50:41.540Z

Reserved: 2025-11-10T22:29:34.877Z

Link: CVE-2025-64765

cve-icon Vulnrichment

Updated: 2025-11-19T21:07:54.357Z

cve-icon NVD

Status : Awaiting Analysis

Published: 2025-11-19T17:15:52.827

Modified: 2025-11-19T19:14:59.327

Link: CVE-2025-64765

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

No data.