{"id":"EUVD-2026-42341","enisaUuid":"ce892f70-9db8-3001-9a69-d23ca3d78df9","description":"Astro is a web framework for content-driven websites. Version 6.4.7 performs authorization decisions on a partially decoded pathname after reaching the iterative URL decoder limit, while later rewrite route matching performs an additional decodeURI() operation and can resolve the request to a protected route. This issue is fixed in version 6.4.8.","datePublished":"Jul 8, 2026, 4:27:18 PM","dateUpdated":"Jul 9, 2026, 2:38:54 PM","baseScore":8.2,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N","references":"https://github.com/withastro/astro/security/advisories/GHSA-vj59-8hwv-xxmv\nhttps://github.com/withastro/astro/pull/17109\nhttps://github.com/withastro/astro/commit/27c80ea92248993e5fce94b2c26d87d611ab6785\nhttps://github.com/withastro/astro/releases/tag/astro@6.4.8\n","aliases":"CVE-2026-59731\nGHSA-vj59-8hwv-xxmv\n","assigner":"GitHub_M","epss":0.33,"enisaIdProduct":[{"id":"29919449-3f00-3cc7-88d0-acadb8fce749","product":{"name":"astro","vendor":{"name":"withastro"}},"product_version":"6.4.7, \u003c 6.4.8"}],"enisaIdVendor":[{"id":"d049f60a-7e66-3fa0-82eb-cd5321fe0126","vendor":{"name":"withastro"}}],"enisaIdVulnerability":[{"id":"1fe8e280-fe43-3528-a49c-219de89ad373","vulnerability":{"id":"GHSA-vj59-8hwv-xxmv","description":"Astro: Authorization Bypass via Decode Iteration Limit and Rewrite Path Canonicalization Mismatch","datePublished":"Jul 20, 2026, 9:58:27 PM","dateUpdated":"Jul 20, 2026, 9:58:27 PM","baseScore":0.0,"references":"https://github.com/withastro/astro/security/advisories/GHSA-vj59-8hwv-xxmv\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-59731\nhttps://github.com/withastro/astro/pull/17109\nhttps://github.com/withastro/astro/commit/27c80ea92248993e5fce94b2c26d87d611ab6785\nhttps://github.com/withastro/astro\nhttps://github.com/withastro/astro/releases/tag/astro@6.4.8\n","enisa_id":"EUVD-2026-42341\n","aliases":"GHSA-vj59-8hwv-xxmv\nCVE-2026-59731\n","epss":0.0,"dataProcessed":"Nov 1, 2026, 2:02:28 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}},{"id":"fa778ec3-a90e-3f74-bb72-cfe13c9d7d9c","vulnerability":{"id":"CVE-2026-59731","description":"Astro is a web framework for content-driven websites. Version 6.4.7 performs authorization decisions on a partially decoded pathname after reaching the iterative URL decoder limit, while later rewrite route matching performs an additional decodeURI() operation and can resolve the request to a protected route. This issue is fixed in version 6.4.8.","datePublished":"Jul 8, 2026, 4:27:18 PM","dateUpdated":"Jul 9, 2026, 2:38:54 PM","status":"PUBLISHED","baseScore":8.2,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N","references":"https://github.com/withastro/astro/security/advisories/GHSA-vj59-8hwv-xxmv\nhttps://github.com/withastro/astro/pull/17109\nhttps://github.com/withastro/astro/commit/27c80ea92248993e5fce94b2c26d87d611ab6785\nhttps://github.com/withastro/astro/releases/tag/astro@6.4.8\n","enisa_id":"EUVD-2026-42341\n","assigner":"GitHub_M","epss":0.33,"dataProcessed":"Nov 7, 2026, 7:21:28 AM","vulnerabilityProduct":[{"id":"ce3c6e9e-d4c9-3f2a-a02d-898ffd6d5468","product":{"name":"astro","vendor":{"name":"withastro"}},"product_version":"6.4.7, \u003c 6.4.8"}],"vulnerabilityVendor":[{"id":"1a35a484-8475-331d-ad25-5fcb77bd9247","vendor":{"name":"withastro"}}]}}],"enisaIdAdvisory":[]}