CVE-2026-59731
CVE-2026-59731 · Astro 6.4.7 Authorization Bypass via Decode Iteration Limit and Rewrite Path Canonicalization Mismatch
Esta página presenta datos de fuentes públicas de vulnerabilidades. Consulta el aviso original antes de actualizar.
Astro is a web framework for content-driven websites. Version 6.4.7 performs authorization decisions on a partially decoded pathname after reaching the iterative URL decoder limit, while later rewrite route matching performs an additional decodeURI() operation and can resolve the request to a protected route. This issue is fixed in version 6.4.8.
CVSS 8.2 · Alta · EPSS 0,3% · Corrección disponible
- Publicación
- Actualización
Pila tecnológica: node
Productos y versiones afectados
Fuentes originales
- https://github.com/withastro/astro/security/advisories/GHSA-vj59-8hwv-xxmv
- https://github.com/withastro/astro/pull/17109
- https://github.com/withastro/astro/commit/27c80ea92248993e5fce94b2c26d87d611ab6785
- https://github.com/withastro/astro/releases/tag/[email protected]
- https://nvd.nist.gov/vuln/detail/CVE-2026-59731