CVE-2026-59731 Astro 6.4.7 Authorization Bypass via Decode Iteration Limit and Rewrite Path Canonicalization Mismatch
Attackers can bypass authorization checks in Astro by exploiting a mismatch between URL decoding limits and rewrite path canonicalization, accessing protected routes.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-59731?
CVE-2026-59731 is a high-severity authentication bypass vulnerability in withastro astro, published on 8 Jul 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Astro is a web framework for content-driven websites. Version 6.4.7 performs authorization decisions on a partially decoded pathname after reaching the iterative URL decoder limit, while later rewrite route matching performs an additional decodeURI() operation and can resolve the request to a protected route. This issue is fixed in version 6.4.8.
Weakness: CWE-647
Which versions are affected by CVE-2026-59731?
2 open source packages ship an affected version, including astro.
| Package | Affected | Fixed in |
|---|---|---|
astro npm | From 6.4.7 | 6.4.8 |
astro npm | From 6.4.7 | 6.4.8 |
How do I fix CVE-2026-59731?
Upgrade astro to 6.4.8 or later.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2026-59731 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-59731 exists.
Sources
Also known as GHSA-vj59-8hwv-xxmv.