Astro CVE-2026-59731

Exploitation requires an Astro 6.4.7 application that enforces access control on routes via the framework's own authorization/middleware layer and uses rewrite-based route matching - the flaw lives in the gap between the auth stage (which reads a path stuck at the iterative decoder limit) and the later decodeURI() rewrite match. The attacker must know or guess a protected route and construct a pathname whose encoding survives past the decoder iteration cap so authorization sees a non-matching path while rewrite matching resolves it to the protected route. Limiting factors: the application must actually rely on Astro-level route authorization (deployments that gate sensitive routes at an upstream proxy or backend are not bypassed this way), and impact is bounded to routes reachable through the rewrite-matching path; per CVSS PR:N/UI:N no authentication or user interaction is needed.

The supplied CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N, base 8.2) describes a network-reachable, low-complexity, unauthenticated bypass with high confidentiality and low integrity impact and no availability impact - consistent with unauthorized read/limited-write access to guarded routes rather than full compromise. No EPSS score, KEV entry, POC, or SSVC decision data was provided, so exploitation probability and automatability cannot be independently quantified; the absence of KEV means there is no evidence of active exploitation, and the absence of a POC means exploit maturity is unproven. The realistic priority is elevated for any Astro deployment that relies on framework-level route authorization for sensitive content, but lower where access control is enforced by a separate upstream layer (reverse proxy, CDN, or backend auth). Because the mechanism depends on how the specific application maps protected routes, real-world impact varies by deployment and should be validated against the vendor advisory.

An attacker crafts a URL to a protected Astro route using multiply percent-encoded path segments so that the pathname still looks unprivileged after Astro's capped iterative decoding, passing the authorization check. Astro's rewrite route matcher then applies its extra decodeURI() pass, canonicalizes the path to the guarded route, and serves protected content to the unauthenticated attacker. No POC has been published, but the low attack complexity and network vector make crafting such a request straightforward once the route-mapping behavior is known.