What is the CVSS score of CVE-2026-59731?

CVE-2026-59731 has a CVSS 3.1 base score of 8.2 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N. EPSS exploitation probability: 0.3%.

Which versions of Astro are affected by CVE-2026-59731?

Astro web framework 6.4.7 and earlier contain an authorization bypass that allows any internet user to access protected application routes and sensitive data.. A patch is available.

Is there a public PoC exploit available for CVE-2026-59731?

Yes, a public proof-of-concept exploit is available for CVE-2026-59731. Prioritise patching immediately. EPSS: 0.3%.

How to fix or mitigate CVE-2026-59731?

Within 24 hours: inventory all Astro deployments and identify instances running version 6.4.7 or earlier; document protected routes and sensitive data handled. Within 7 days: upgrade to Astro 6.4.8 or later on all production and staging environments; validate authorization controls through manual testing of protected route access. Within 30 days: review access logs for unauthorized access patterns; assess what protected data may have been accessed during the vulnerable window.

Astro CVE-2026-59731

EUVD-2026-42341 HIGH

Use of Non-Canonical URL Paths for Authorization Decisions (CWE-647)

2026-07-08 GitHub_M

GHSA-vj59-8hwv-xxmv

Information Disclosure Astro

8.2

CVSS 3.1 · Vendor: GitHub_M

Severity by source

Vendor (GitHub_M) PRIMARY

8.2 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N

vuln.today AI

8.2 HIGH

Remote, unauthenticated, low-complexity path-normalization bypass reaching protected routes gives high confidentiality and low integrity impact with no availability effect and no scope change.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (GitHub_M).

CVSS VectorVendor: GitHub_M

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

Low

Availability

None

Lifecycle Timeline

Patch available

Jul 08, 2026 - 18:02 EUVD

Analysis Generated

Jul 08, 2026 - 17:24 vuln.today

DescriptionCVE.org

Astro is a web framework for content-driven websites. Version 6.4.7 performs authorization decisions on a partially decoded pathname after reaching the iterative URL decoder limit, while later rewrite route matching performs an additional decodeURI() operation and can resolve the request to a protected route. This issue is fixed in version 6.4.8.

AnalysisAI

Authorization bypass in the Astro web framework version 6.4.7 lets remote unauthenticated attackers reach protected routes by exploiting an inconsistency between how the framework decodes URL paths for auth decisions versus route matching. Because authorization runs against a path that hit the iterative URL-decoder limit while later rewrite matching applies an extra decodeURI(), a request that appears benign at the auth gate resolves to a guarded route afterward, exposing protected content. No public exploit has been identified at time of analysis, but the fix in 6.4.8 and a published GitHub Security Advisory confirm the flaw.

Technical ContextAI

Astro is a JavaScript/TypeScript web framework for content-driven and server-rendered websites (CPE cpe:2.3:a:withastro:astro), where middleware and route guards commonly enforce access control before a request is dispatched to a page or endpoint. The root cause maps to CWE-647 (Use of Non-Canonical URL Paths for Authorization Decisions): Astro's request pipeline caps the number of iterative percent-decoding passes on the pathname, so authorization evaluates a still-partially-encoded path, but the subsequent rewrite route-matching stage performs an additional decodeURI() pass. This second decode can canonicalize the path into one that matches a protected route the authorization layer never saw, producing a classic parser-differential / path-normalization desync between the security check and the routing logic.

RemediationAI

Vendor-released patch: 6.4.8 - upgrade Astro to 6.4.8 or later (npm install astro@6.4.8) as the primary and complete fix, per the release at https://github.com/withastro/astro/releases/tag/astro@6.4.8 and advisory GHSA-vj59-8hwv-xxmv. If an immediate upgrade is not possible, enforce authorization at a layer that sees the fully canonicalized path - for example, add reverse-proxy or CDN rules that normalize and fully percent-decode the URL before applying access rules, or block requests containing multiply-encoded sequences (e.g. %25 that decodes to a further %-escape) to protected path prefixes; the trade-off is that overly strict encoding filters can break legitimately encoded URLs and must be tested. As a stopgap, move sensitive route protection out of Astro's in-framework matching into an independent backend auth check keyed on the decoded route, accepting the added integration effort. Review the changes in PR https://github.com/withastro/astro/pull/17109 (commit 27c80ea92248993e5fce94b2c26d87d611ab6785) to validate any custom middleware.