Astro has an Authentication Bypass via Double URL Encoding, a bypass for CVE-2025-64765

Description

No description available.

Recommendation

Update the astro package to the latest compatible version. Followings are version details:

• Affected version(s): < 5.15.8
• Patched version(s): 5.15.8

References

• GHSA-whqg-ppgf-wp8c
• CVE-2025-66202
• CWE-647
• CAPEC-310
• OWASP 2021-A6

Related Issues

• CouchAuth has a Server-Side Template Injection vulnerability in its email functionality - CVE-2024-57177
• Astro Cloudflare adapter has Stored Cross-site Scripting vulnerability in /_image endpoint - CVE-2025-65019
• Astro's middleware authentication checks based on url.pathname can be bypassed via url encoded values - CVE-2025-64765
• Astro development server error page is vulnerable to reflected Cross-site Scripting - CVE-2025-64745

Tags:

npm

astro