EUVD-2026-42341Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N
Remote, unauthenticated, low-complexity path-normalization bypass reaching protected routes gives high confidentiality and low integrity impact with no availability effect and no scope change.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N
Lifecycle Timeline
2DescriptionCVE.org
Astro is a web framework for content-driven websites. Version 6.4.7 performs authorization decisions on a partially decoded pathname after reaching the iterative URL decoder limit, while later rewrite route matching performs an additional decodeURI() operation and can resolve the request to a protected route. This issue is fixed in version 6.4.8.
AnalysisAI
Authorization bypass in the Astro web framework version 6.4.7 lets remote unauthenticated attackers reach protected routes by exploiting an inconsistency between how the framework decodes URL paths for auth decisions versus route matching. Because authorization runs against a path that hit the iterative URL-decoder limit while later rewrite matching applies an extra decodeURI(), a request that appears benign at the auth gate resolves to a guarded route afterward, exposing protected content. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires an Astro 6.4.7 application that enforces access control on routes via the framework's own authorization/middleware layer and uses rewrite-based route matching - the flaw lives in the gap between the auth stage (which reads a path stuck at the iterative decoder limit) and the later decodeURI() rewrite match. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The supplied CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N, base 8.2) describes a network-reachable, low-complexity, unauthenticated bypass with high confidentiality and low integrity impact and no availability impact - consistent with unauthorized read/limited-write access to guarded routes rather than full compromise. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker crafts a URL to a protected Astro route using multiply percent-encoded path segments so that the pathname still looks unprivileged after Astro's capped iterative decoding, passing the authorization check. Astro's rewrite route matcher then applies its extra decodeURI() pass, canonicalizes the path to the guarded route, and serves protected content to the unauthenticated attacker. … |
| Remediation | Vendor-released patch: 6.4.8 - upgrade Astro to 6.4.8 or later (npm install astro@6.4.8) as the primary and complete fix, per the release at https://github.com/withastro/astro/releases/tag/astro@6.4.8 and advisory GHSA-vj59-8hwv-xxmv. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: inventory all Astro deployments and identify instances running version 6.4.7 or earlier; document protected routes and sensitive data handled. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
SQL Injection exists in the Saxum Astro 4.0.14 component for Joomla!. Rated critical severity (CVSS 9.8), this vulnerabi
Astro is a web framework for content-driven websites. Rated high severity (CVSS 7.8), this vulnerability is remotely exp
Astro is a web framework. Rated high severity (CVSS 7.1), this vulnerability is remotely exploitable, no authentication
Astro is a web framework for content-driven websites. Rated medium severity (CVSS 6.9), this vulnerability is remotely e
Astro is a web framework. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, no authenticatio
Astro is a web framework for content-driven websites. Rated medium severity (CVSS 5.5), this vulnerability is remotely e
Clerk JavaScript is the official JavaScript repository for Clerk authentication. createRouteMatcher in @clerk/nextjs, @c
Sentry-Javascript is official Sentry SDKs for JavaScript. Rated high severity (CVSS 7.5), this vulnerability is remotely
The @astrojs/vercel serverless adapter in Astro versions prior to 10.0.2 contains an unauthenticated path traversal vuln
Astro is a web framework for content-driven websites. Rated medium severity (CVSS 6.5), this vulnerability is remotely e
Astro web framework versions prior to 10.0.0 contain an unbounded JSON parsing vulnerability in the Server Islands POST
The Astro web framework has a DOM Clobbering gadget in the client-side router starting in version 3.0.0 and prior to ver
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today