- Description
- Astro is a web framework. Prior to version 5.15.8, a mismatch exists between how Astro normalizes request paths for routing/rendering and how the application’s middleware reads the path for validation checks. Astro internally applies decodeURI() to determine which route to render, while the middleware uses context.url.pathname without applying the same normalization (decodeURI). This discrepancy may allow attackers to reach protected routes using encoded path variants that pass routing but bypass validation checks. This issue has been patched in version 5.15.8.
- Source
- security-advisories@github.com
- NVD status
- Analyzed
- Products
- astro
CVSS 4.0
- Type
- Secondary
- Base score
- 6.9
- Impact score
- -
- Exploitability score
- -
- Vector string
- CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
- Severity
- MEDIUM
CVSS 3.1
- Type
- Primary
- Base score
- 5.3
- Impact score
- 1.4
- Exploitability score
- 3.9
- Vector string
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
- Severity
- MEDIUM
- security-advisories@github.com
- CWE-22
- Hype score
- Not currently trending
I discovered my first two CVEs while researching the Astro framework (800k+ weekly downloads, 50k+⭐). • CVE-2025-65019: XSS via unsafe data: protocol in image loading • CVE-2025-66202: Path-based middleware auth bypass (bypasses CVE-2025-64765 using dpl URL encoding. https
@zomasec
27 Nov 2025
154 Impressions
0 Retweets
5 Likes
0 Bookmarks
1 Reply
0 Quotes
CVE-2025-64765 Astro is a web framework. Prior to version 5.15.8, a mismatch exists between how Astro normalizes request paths for routing/rendering and how the application’s middle… https://t.co/ipK809jsLa
@CVEnew
19 Nov 2025
140 Impressions
0 Retweets
0 Likes
0 Bookmarks
0 Replies
0 Quotes
[
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:astro:astro:*:*:*:*:*:node.js:*:*",
"matchCriteriaId": "1015DFA8-9106-453C-9144-11E63ADA3B67",
"versionEndExcluding": "5.15.8",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
]