Astro has an Authentication Bypass via Double URL Encoding, a bypass for CVE-2025-64765

Description

No description available.

Recommendation

Update the astro package to the latest compatible version. Followings are version details:

• Affected version(s): < 5.15.8
• Patched version(s): 5.15.8

References

• GHSA-whqg-ppgf-wp8c
• CVE-2025-66202
• CWE-647
• CAPEC-310
• OWASP 2021-A6

Related Issues

• Astro's middleware authentication checks based on url.pathname can be bypassed via url encoded values - CVE-2025-64765
• FUXA has JWT Authentication Bypass via HTTP Referer header spoofing - CVE-2025-69985
• Astro vulnerable to URL manipulation via headers, leading to middleware and CVE-2025-61925 bypass - CVE-2025-64525
• fast-xml-parser has an entity encoding bypass via regex injection in DOCTYPE entity names - CVE-2026-25896

Tags:

npm

astro