{"id":"EUVD-2025-201717","enisaUuid":"92187f32-91ec-3a58-8c7d-c782d58e7262","description":"Astro is a web framework. Versions 5.15.7 and below have a double URL encoding bypass which allows any unauthenticated attacker to bypass path-based authentication checks in Astro middleware, granting unauthorized access to protected routes. While the original CVE-2025-64765 was fixed in v5.15.8, the fix is insufficient as it only decodes once. By using double-encoded URLs, attackers can still bypass authentication and access any route protected by middleware pathname checks. This issue is fixed in version 5.15.8.","datePublished":"Dec 8, 2025, 11:41:21 PM","dateUpdated":"Dec 9, 2025, 4:04:07 PM","baseScore":6.5,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","references":"https://github.com/withastro/astro/security/advisories/GHSA-whqg-ppgf-wp8c\nhttps://github.com/withastro/astro/security/advisories/GHSA-ggxq-hp9w-j794\nhttps://github.com/withastro/astro/commit/6f800813516b07bbe12c666a92937525fddb58ce\n","aliases":"CVE-2025-66202\nGHSA-whqg-ppgf-wp8c\n","assigner":"GitHub_M","epss":0.31,"enisaIdProduct":[{"id":"436a370d-d6a3-3143-a2ed-e2f91fce36d9","product":{"name":"astro","vendor":{"name":"withastro"}},"product_version":"\u003c 5.15.8"}],"enisaIdVendor":[{"id":"a69a7016-e5aa-3da2-830c-19b3cc0b36bd","vendor":{"name":"withastro"}}],"enisaIdVulnerability":[{"id":"5de4e4b4-941a-3995-aa6b-dc9fb592c896","vulnerability":{"id":"CVE-2025-66202","description":"Astro is a web framework. Versions 5.15.7 and below have a double URL encoding bypass which allows any unauthenticated attacker to bypass path-based authentication checks in Astro middleware, granting unauthorized access to protected routes. While the original CVE-2025-64765 was fixed in v5.15.8, the fix is insufficient as it only decodes once. By using double-encoded URLs, attackers can still bypass authentication and access any route protected by middleware pathname checks. This issue is fixed in version 5.15.8.","datePublished":"Dec 8, 2025, 11:41:21 PM","dateUpdated":"Dec 9, 2025, 4:04:07 PM","status":"PUBLISHED","baseScore":6.5,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","references":"https://github.com/withastro/astro/security/advisories/GHSA-whqg-ppgf-wp8c\nhttps://github.com/withastro/astro/security/advisories/GHSA-ggxq-hp9w-j794\nhttps://github.com/withastro/astro/commit/6f800813516b07bbe12c666a92937525fddb58ce\n","enisa_id":"EUVD-2025-201717\n","assigner":"GitHub_M","epss":0.31,"dataProcessed":"Nov 2, 2026, 7:21:27 AM","vulnerabilityProduct":[{"id":"f4843fc4-05b2-3be8-b27a-54264676802e","product":{"name":"astro","vendor":{"name":"withastro"}},"product_version":"\u003c 5.15.8"}],"vulnerabilityVendor":[{"id":"8bd50f76-683b-3279-9ac2-c6bedf6e2f33","vendor":{"name":"withastro"}}]}},{"id":"d2fcdab9-69f0-38eb-9086-968ec6158eef","vulnerability":{"id":"GHSA-whqg-ppgf-wp8c","description":"Astro has an Authentication Bypass via Double URL Encoding, a bypass for CVE-2025-64765","datePublished":"Dec 8, 2025, 4:26:43 PM","dateUpdated":"Dec 9, 2025, 4:28:41 PM","baseScore":0.0,"references":"https://github.com/withastro/astro/security/advisories/GHSA-ggxq-hp9w-j794\nhttps://github.com/withastro/astro/security/advisories/GHSA-whqg-ppgf-wp8c\nhttps://nvd.nist.gov/vuln/detail/CVE-2025-64765\nhttps://nvd.nist.gov/vuln/detail/CVE-2025-66202\nhttps://github.com/withastro/astro/commit/6f800813516b07bbe12c666a92937525fddb58ce\nhttps://github.com/withastro/astro\n","enisa_id":"EUVD-2025-201717\n","aliases":"CVE-2025-66202\nGHSA-whqg-ppgf-wp8c\n","epss":0.0,"dataProcessed":"Nov 1, 2026, 1:56:58 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}}],"enisaIdAdvisory":[]}